Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
explorer.exe.0.exe

Overview

General Information

Sample name:explorer.exe.0.exe
(renamed file extension from dr to exe)
Original sample name:explorer.exe.0.dr
Analysis ID:1439468
MD5:490b24aaabfd71dc7561947289b252a5
SHA1:ac2d9ec2cd024fff564e4e397ec8fbc9e65594d2
SHA256:2ebd029b1d588dda7d230b3776c3fa99c399f90449cd2dbdd79b071331efe4c6
Infos:

Detection

Score:56
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Contains functionality to infect the boot sector
Found pyInstaller with non standard icon
Hides threads from debuggers
Modifies the context of a thread in another process (thread injection)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • explorer.exe.0.exe (PID: 6740 cmdline: "C:\Users\user\Desktop\explorer.exe.0.exe" MD5: 490B24AAABFD71DC7561947289B252A5)
    • conhost.exe (PID: 5332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe.0.exe (PID: 1432 cmdline: "C:\Users\user\Desktop\explorer.exe.0.exe" MD5: 490B24AAABFD71DC7561947289B252A5)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
No Snort rule has matched

Click to jump to signature section

Show All Signature Results
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A380F0 CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,5_2_70A380F0
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info\LICENSE.txtJump to behavior
Source: explorer.exe.0.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: explorer.exe.0.exe, 00000000.00000003.1857082217.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: explorer.exe.0.exe, 00000000.00000003.1856820452.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: explorer.exe.0.exe, 00000000.00000003.1825011333.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\_win32sysloader.pdb source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: explorer.exe.0.exe, 00000000.00000003.1855172965.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: explorer.exe.0.exe, 00000000.00000003.1857082217.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ~/.pdbrc source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093124256.0000019694513000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2086176783.000001968D1B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.000001969455E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065663654.000001968D1A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071854636.000001968D1AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068928730.000001968D1AA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb.Pdb source: explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092430348.00000196943D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.00000196943D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.000001969455E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32trace.pdb source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092430348.00000196943D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.00000196943D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093124256.0000019694513000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: explorer.exe.0.exe, 00000000.00000003.1855172965.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc0 source: explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093124256.0000019694513000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092369096.00000196943C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D8110 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF75C2D8110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2C7B80 FindFirstFileExW,FindClose,0_2_00007FF75C2C7B80
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E20D4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF75C2E20D4
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D8110 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF75C2D8110
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI67402\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 4x nop then push rbp5_2_70A2BD40
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 4x nop then push rbp5_2_70A2BD40
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: explorer.exe.0.exe, 00000005.00000002.2091283468.000001968E010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: YouTube: https://www.youtube.com/c/NeuralNine equals www.youtube.com (Youtube)
Source: global trafficDNS traffic detected: DNS query: drive.usercontent.google.com
Source: explorer.exe.0.exe, 00000005.00000002.2096096049.0000019695400000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: explorer.exe.0.exe, 00000005.00000002.2090915252.000001968DCE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://aka.ms/vcpython27
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arxiv.org/abs/1805.10941.
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2094435662.0000019694815000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074154065.0000019694815000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070779912.00000196945BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069084888.000001969476F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062508627.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070065434.0000019694814000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069084888.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2072594031.00000196945BD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078797208.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071943201.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093942934.0000019694793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: explorer.exe.0.exe, 00000005.00000002.2095422757.00000196950A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858012392.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1832108685.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE891000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: explorer.exe.0.exe, 00000005.00000003.2060335185.000001969490E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certign
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062508627.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061547086.00000196947B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061387851.000001969498F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061547086.00000196947B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlance
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlLL
Source: explorer.exe.0.exe, 00000005.00000002.2094784332.0000019694980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: explorer.exe.0.exe, 00000005.00000002.2094784332.0000019694980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: explorer.exe.0.exe, 00000005.00000003.2075629284.00000196946EB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: explorer.exe.0.exe, 00000005.00000003.2070306490.000001968CF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076777661.000001968CF80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093057347.00000196944FD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: explorer.exe.0.exe, 00000005.00000003.2070306490.000001968CF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076777661.000001968CF80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl9
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858012392.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1832108685.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE891000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858012392.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1832108685.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE891000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858012392.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1832108685.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE891000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe.0.exe, 00000005.00000003.2070779912.00000196945BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2072594031.00000196945BD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075961660.00000196945BF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069084888.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078797208.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071943201.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093942934.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077220802.0000019694793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2069084888.000001969476F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2070370911.00000196945C2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074283583.00000196945C3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074594955.00000196945C5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078286018.0000019695700000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2096541037.0000019695800000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076504779.0000019694651000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075858126.000001969464C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.000001969469B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093511119.00000196945C6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062148512.0000019694644000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: explorer.exe.0.exe, 00000005.00000002.2096096049.0000019695400000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D875000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067014279.000001968D8DC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2088894799.000001968D8DF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D875000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064321201.000001968D886000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2070044559.000001968D16D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2016710838.000001968D2AE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2016780116.000001968D721000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069739103.000001968D148000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2085835955.000001968D16F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/pprint.html#pprint.pprint
Source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.000001969455E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
Source: explorer.exe.0.exe, 00000005.00000002.2087752969.000001968D590000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://github.com/ActiveState/appdirs
Source: explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093185446.0000019694559000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070904617.0000019694423000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.0000019694408000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093185446.0000019694559000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail
Source: explorer.exe.0.exe, 00000005.00000003.2069516433.000001969431A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: explorer.exe.0.exe, 00000005.00000003.2070370911.00000196945C2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/
Source: explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://json.org
Source: explorer.exe.0.exe, 00000005.00000002.2096162760.0000019695440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063628213.0000019694329000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068720582.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067505616.000001969432D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091896473.000001969432E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/BinomialDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/CauchyDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/GammaDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/HypergeometricDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/LaplaceDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/LogisticDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/NegativeBinomialDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/NoncentralF-Distribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/PoissonDistribution.html
Source: explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/SincFunction.html
Source: explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858012392.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1832108685.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1839201869.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE891000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093422934.00000196945B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://portaudio.com/docs/v19-doxydocs/portaudio_8h.html#a8a60fb2a5ec9cbade3f54a9c978e2710
Source: explorer.exe.0.exe, 00000005.00000002.2089128924.000001968D95A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
Source: explorer.exe.0.exe, 00000005.00000003.2016780116.000001968D721000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070616430.000001968CEB7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065077852.000001968CEAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pyparsing.wikispaces.com
Source: explorer.exe.0.exe, 00000005.00000003.2061795851.0000019694908000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060398051.00000196948F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077125931.0000019694659000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2094583726.0000019694909000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076504779.0000019694651000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075858126.000001969464C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061547086.00000196947B7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062148512.0000019694644000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/0
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061547086.00000196947B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/m
Source: explorer.exe.0.exe, 00000005.00000003.2077125931.0000019694659000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076504779.0000019694651000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075858126.000001969464C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062148512.0000019694644000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/qy6-
Source: explorer.exe.0.exe, 00000005.00000003.2063033484.000001968D757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2016710838.000001968D2AE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2016780116.000001968D721000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2088278179.000001968D759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular-
Source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092369096.00000196943C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tip.tcl.tk/48)
Source: explorer.exe.0.exe, 00000005.00000003.2062714316.0000019694408000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2079672439.0000019694424000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069928699.000001969441F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090508419.000001968DAFE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070904617.0000019694423000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.0000019694408000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: explorer.exe.0.exe, 00000005.00000002.2096464152.0000019695780000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2096618507.00000196958C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2079255077.0000019694567000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.0000019694563000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093231497.0000019694567000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.000001969470C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076574226.0000019694709000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074499278.00000196946C0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093624395.00000196946C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077125931.00000196946C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074499278.00000196946C0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093624395.00000196946C9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077125931.00000196946C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlk&
Source: explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ams.org/journals/mcom/1988-51-184/
Source: explorer.exe.0.exe, 00000005.00000002.2087591337.000001968D4A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: explorer.exe.0.exe, 00000005.00000003.2061449551.0000019694796000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.000001969469B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
Source: explorer.exe.0.exe, 00000005.00000003.2061449551.0000019694796000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/nw
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2094435662.0000019694815000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074154065.0000019694815000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062508627.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070065434.0000019694814000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067995058.00000196947B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2078173062.0000019695740000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.dabeaz.com/ply)
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067422614.000001968D9D9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2089778901.000001968D9DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.doi.org/10.1109/IEEESTD.2008.4610935
Source: explorer.exe.0.exe, 00000005.00000003.2060398051.00000196948F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078797208.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/index.html
Source: explorer.exe.0.exe, 00000005.00000003.2064560769.000001968D87A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D875000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D875000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068110574.000001968D881000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064485458.000001968D875000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.inference.org.uk/mackay/itila/
Source: explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html
Source: explorer.exe.0.exe, 00000005.00000002.2089128924.000001968D95A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D7F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061879407.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070399264.000001968D82E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/
Source: explorer.exe.0.exe, 00000005.00000002.2087486863.000001968D460000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: explorer.exe.0.exe, 00000005.00000003.2013406270.000001968CEE1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2085414679.000001968CFD0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2013691427.000001968CEED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: explorer.exe.0.exe, 00000005.00000002.2086231614.000001968D1C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065540382.000001968D1C0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: explorer.exe.0.exe, 00000005.00000002.2086231614.000001968D1C1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065540382.000001968D1C0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps$
Source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2079255077.0000019694567000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.0000019694563000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093231497.0000019694567000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.000001969470C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076574226.0000019694709000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: explorer.exe.0.exe, 00000005.00000003.2065449391.000001968D78D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D775000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.scipy.org/not/real/data.txt
Source: explorer.exe.0.exe, 00000005.00000003.2069084888.000001969476F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093942934.0000019694773000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077220802.0000019694773000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071943201.0000019694772000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xyz.edu/data
Source: explorer.exe.0.exe, 00000005.00000003.2070779912.00000196945BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2072594031.00000196945BD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075961660.00000196945BF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093185446.0000019694559000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://yahoo.com/
Source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: explorer.exe.0.exe, 00000005.00000002.2095762637.00000196952E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cloud.google.com/appengine/docs/standard/runtimes
Source: explorer.exe.0.exe, 00000005.00000003.2066579767.000001968D9B5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2089696281.000001968D9B9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065160675.000001968D998000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067484924.000001968D9B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://data-apis.org/array-api/latest/design_topics/data_interchange.html#syntax-for-data-interchan
Source: explorer.exe.0.exe, 00000005.00000003.2066579767.000001968D9B5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2089696281.000001968D9B9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065160675.000001968D998000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067484924.000001968D9B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dmlc.github.io/dlpack/latest/python_spec.html
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA87000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/library/string.html#format-specification-mini-language
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DAB7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064620989.000001968DAB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/user/basics.io.genfromtxt.html
Source: explorer.exe.0.exe, 00000005.00000002.2091534482.0000019694190000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/user/numpy-for-matlab-users.html).
Source: explorer.exe.0.exe, 00000005.00000002.2090956723.000001968DD20000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2096656021.0000019695970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1jXogZ3BVhm3hMU_kRpqaBt9g52obIRtw&export=download
Source: explorer.exe.0.exe, 00000005.00000002.2096656021.0000019695970000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1jXogZ3BVhm3hMU_kRpqaBt9g52obIRtw&export=download0
Source: explorer.exe.0.exe, 00000005.00000002.2090956723.000001968DD20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1jXogZ3BVhm3hMU_kRpqaBt9g52obIRtw&export=downloadns
Source: explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D7F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070306490.000001968CF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2088599211.000001968D7F1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061879407.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076777661.000001968CF80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://drive.usercontent.google.com/download?id=1jXogZ3BVhm3hMU_kRpqaBt9g52obIRtw&export=downloadz
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/imneme/540829265469e673d045
Source: explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: explorer.exe.0.exe, 00000005.00000002.2084190766.000001968AF83000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063844993.000001968AF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074671812.000001968AF82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065636498.000001968D9DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066648460.000001968D9DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/arogozhnikov/einops
Source: explorer.exe.0.exe, 00000005.00000002.2095655684.0000019695230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: explorer.exe.0.exe, 00000005.00000002.2095655684.0000019695230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pyperclip/issues/550p$
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066441487.000001968DA26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joblib/threadpoolctl
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103666296.00000232EE8BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE8BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
Source: explorer.exe.0.exe, 00000005.00000002.2091070270.000001968DEB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/nu
Source: explorer.exe.0.exe, 00000005.00000002.2094864024.0000019694B10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/numpy/numpy/issues/4763
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065585358.000001968DA4F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pydata/bottleneck
Source: explorer.exe.0.exe, 00000005.00000002.2087791858.000001968D5D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090827906.000001968DC60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packaging
Source: explorer.exe.0.exe, 00000005.00000002.2087791858.000001968D5D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090827906.000001968DC60000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/packagingEI67402
Source: explorer.exe.0.exe, 00000005.00000002.2090740273.000001968DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: explorer.exe.0.exe, 00000005.00000002.2090578446.000001968DB20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: explorer.exe.0.exe, 00000005.00000002.2095271886.0000019694FD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
Source: explorer.exe.0.exe, 00000005.00000002.2089294065.000001968D971000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080124288.000001968D96D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.7/Objects/listsort.txt
Source: explorer.exe.0.exe, 00000005.00000002.2084447686.000001968C7B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: explorer.exe.0.exe, 00000005.00000002.2084190766.000001968AF83000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063844993.000001968AF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074671812.000001968AF82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: explorer.exe.0.exe, 00000005.00000002.2084190766.000001968AF83000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063844993.000001968AF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074671812.000001968AF82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: explorer.exe.0.exe, 00000005.00000002.2095842696.0000019695320000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: explorer.exe.0.exe, 00000005.00000002.2089128924.000001968D96A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipython.org
Source: explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D7F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061879407.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070399264.000001968D82E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://metacpan.org/pod/distribution/Math-Cephes/lib/Math/Cephes.pod#i0:-Modified-Bessel-function-o
Source: explorer.exe.0.exe, 00000005.00000002.2095655684.0000019695230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mouseinfo.readthedocs.io
Source: explorer.exe.0.exe, 00000005.00000002.2095655684.0000019695230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mouseinfo.readthedocs.iop
Source: explorer.exe.0.exe, 00000005.00000002.2089128924.000001968D96A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org
Source: explorer.exe.0.exe, 00000005.00000003.2029602643.000001968D219000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecations
Source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecationsed
Source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092369096.00000196943C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecationsider
Source: explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090508419.000001968DAFE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/devdocs/release/1.20.0-notes.html#deprecationsq
Source: explorer.exe.0.exe, 00000005.00000002.2091408985.000001968E0D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D875000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D875000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064805667.000001968D8E6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064321201.000001968D886000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/devdocs/release/1.25.0-notes.html
Source: explorer.exe.0.exe, 00000005.00000002.2091701305.0000019694290000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/doc/stable/reference/random/index.html
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068669311.000001968D9E7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065636498.000001968D9DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066648460.000001968D9DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/neps/nep-0013-ufunc-overrides.html
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.000001969469B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065636498.000001968D9DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066648460.000001968D9DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://optimized-einsum.readthedocs.io/en/stable/
Source: explorer.exe.0.exe, 00000005.00000003.2063449734.000001968D7F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2088641168.000001968D82F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061879407.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070399264.000001968D82E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDF
Source: explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_379.htm
Source: explorer.exe.0.exe, 00000005.00000003.2062487541.00000196943B3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_67.htm
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092222823.00000196943A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063607000.00000196943A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_69.htm
Source: explorer.exe.0.exe, 00000005.00000003.2063011812.00000196943A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068069671.00000196943B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062487541.00000196943B3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_79.htm
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092222823.00000196943A1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063607000.00000196943A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_83.htm
Source: explorer.exe.0.exe, 00000005.00000003.2063011812.00000196943A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068069671.00000196943B8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062487541.00000196943B3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092222823.00000196943AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://personal.math.ubc.ca/~cbm/aands/page_86.htm
Source: explorer.exe.0.exe, 00000005.00000002.2095422757.00000196950A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0u
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0v
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0w
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0x
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0y
Source: explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial0z
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066441487.000001968DA26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073997591.000001968DA31000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090076093.000001968DA33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/threadpoolctl/
Source: explorer.exe.0.exe, 00000005.00000002.2096021872.00000196953B0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: explorer.exe.0.exe, 00000005.00000002.2084829520.000001968CEB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070616430.000001968CEB7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065077852.000001968CEAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://scipy-cookbook.readthedocs.io/items/Ctypes.html
Source: explorer.exe.0.exe, 00000005.00000003.2015865397.000001968D14A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html#basic-resource-access
Source: explorer.exe.0.exe, 00000005.00000002.2095380939.0000019695060000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: explorer.exe.0.exe, 00000005.00000002.2095380939.0000019695060000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stat.ethz.ch/~stahel/lognormal/bioscience.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092430348.00000196943D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.00000196943D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069084888.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078797208.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071943201.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093942934.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077220802.0000019694793000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: explorer.exe.0.exe, 00000005.00000003.2060864313.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2094435662.0000019694815000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074154065.0000019694815000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062508627.0000019694807000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070065434.0000019694814000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067995058.00000196947B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: explorer.exe.0.exe, 00000005.00000002.2090740273.000001968DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/
Source: explorer.exe.0.exe, 00000005.00000002.2090740273.000001968DBE0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://upload.pypi.org/legacy/0
Source: explorer.exe.0.exe, 00000005.00000002.2095762637.00000196952E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: explorer.exe.0.exe, 00000005.00000002.2095696078.0000019695270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings0
Source: explorer.exe.0.exe, 00000005.00000003.2062464692.000001968D763000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063585391.000001968D76B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2088327504.000001968D76C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20080221202153/https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.asp
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp
Source: explorer.exe.0.exe, 00000005.00000002.2084829520.000001968CEB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070616430.000001968CEB7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065077852.000001968CEAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cs.hmc.edu/tr/hmc-cs-2014-0905.pdf
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833292666.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1838979118.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1829380619.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1835493270.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1836250110.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1844199428.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1840159589.00000232EE884000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE891000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
Source: explorer.exe.0.exe, 00000005.00000003.2070370911.00000196945C2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074283583.00000196945C3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074594955.00000196945C5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093511119.00000196945C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3663.htm
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063628213.0000019694329000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068720582.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067505616.000001969432D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091896473.000001969432E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htm
Source: explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066441487.000001968DA26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073997591.000001968DA31000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090076093.000001968DA33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mathworks.com/help/techdoc/ref/rank.html
Source: explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066441487.000001968DA26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openblas.net/
Source: explorer.exe.0.exe, 00000005.00000003.2079752033.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080175388.000001968CF68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: explorer.exe.0.exe, 00000005.00000002.2091746203.00000196942D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: explorer.exe.0.exe, 00000005.00000002.2091283468.000001968E010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/c/NeuralNine
Source: explorer.exe.0.exe, 00000005.00000003.2060398051.00000196948F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
Source: unknownNetwork traffic detected: HTTP traffic on port 49748 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49748
Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A97091: DeviceIoControl,5_2_70A97091
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E65600_2_00007FF75C2E6560
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D81100_2_00007FF75C2D8110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2C6B500_2_00007FF75C2C6B50
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E74AC0_2_00007FF75C2E74AC
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D0D800_2_00007FF75C2D0D80
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D15A00_2_00007FF75C2D15A0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2DEDF00_2_00007FF75C2DEDF0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D36540_2_00007FF75C2D3654
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D27040_2_00007FF75C2D2704
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2DA6F00_2_00007FF75C2DA6F0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D0F840_2_00007FF75C2D0F84
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2DE7700_2_00007FF75C2DE770
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E6F600_2_00007FF75C2E6F60
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D7F5C0_2_00007FF75C2D7F5C
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D17A40_2_00007FF75C2D17A4
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E67DC0_2_00007FF75C2E67DC
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E20D40_2_00007FF75C2E20D4
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E490C0_2_00007FF75C2E490C
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E11280_2_00007FF75C2E1128
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D89940_2_00007FF75C2D8994
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D11900_2_00007FF75C2D1190
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D61800_2_00007FF75C2D6180
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2EA1E80_2_00007FF75C2EA1E8
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D321C0_2_00007FF75C2D321C
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D81100_2_00007FF75C2D8110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D3A580_2_00007FF75C2D3A58
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2DE2DC0_2_00007FF75C2DE2DC
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D13940_2_00007FF75C2D1394
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D236C0_2_00007FF75C2D236C
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E11280_2_00007FF75C2E1128
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E44700_2_00007FF75C2E4470
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2C84A00_2_00007FF75C2C84A0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A0E6F05_2_70A0E6F0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A0A7B05_2_70A0A7B0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6FFB05_2_70A6FFB0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3A0A05_2_70A3A0A0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3D8005_2_70A3D800
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3E8605_2_70A3E860
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A771905_2_70A77190
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A271105_2_70A27110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3B1105_2_70A3B110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A7D9105_2_70A7D910
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A239405_2_70A23940
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A5E1405_2_70A5E140
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A439505_2_70A43950
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6E1505_2_70A6E150
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A35AF05_2_70A35AF0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A0F2205_2_70A0F220
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A382705_2_70A38270
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A362505_2_70A36250
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A013E05_2_70A013E0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6C3305_2_70A6C330
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3D3105_2_70A3D310
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A223605_2_70A22360
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A573705_2_70A57370
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6BB705_2_70A6BB70
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3EC805_2_70A3EC80
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A34C205_2_70A34C20
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6CC155_2_70A6CC15
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A24DA05_2_70A24DA0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A265B05_2_70A265B0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A965E05_2_70A965E0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A7DDF05_2_70A7DDF0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A38DC05_2_70A38DC0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6EDC05_2_70A6EDC0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A7E5105_2_70A7E510
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A315705_2_70A31570
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A225405_2_70A22540
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A2BD405_2_70A2BD40
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A41D405_2_70A41D40
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3B5505_2_70A3B550
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A436D05_2_70A436D0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A07E205_2_70A07E20
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A31E305_2_70A31E30
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A6D6305_2_70A6D630
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A29E705_2_70A29E70
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A18E405_2_70A18E40
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A56FE25_2_70A56FE2
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A0F7C05_2_70A0F7C0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A3CF205_2_70A3CF20
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A36F005_2_70A36F00
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A407005_2_70A40700
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A26F705_2_70A26F70
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: String function: 70A04230 appears 238 times
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: String function: 70A2D400 appears 325 times
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: String function: 70A96CA0 appears 192 times
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: String function: 00007FF75C2C2010 appears 52 times
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: String function: 70A96730 appears 31 times
Source: opencv_videoio_ffmpeg490_64.dll.0.drStatic PE information: Number of sections : 13 > 10
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: Number of sections : 19 > 10
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: explorer.exe.0.exe, 00000000.00000003.1859356732.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindowsvistastyle.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1858290216.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebgl.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1837058821.00000232EE884000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5QmlModels.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1825011333.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140_1.dllT vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1823235685.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqxdgdesktopportal.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1833273019.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtga.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqicns.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1857398134.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwebp.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1829106176.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqgif.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1858012392.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqoffscreen.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwbmp.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1855172965.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtuiotouchplugin.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1857082217.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqtiff.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1857695747.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqminimal.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1856820452.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvg.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103666296.00000232EE8BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1856560301.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqjpeg.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32crypt.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1835470029.00000232EE88A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Network.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1843788419.00000232EE884000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE8BA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshell.pyd0 vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1832127944.00000232EE884000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5DBus.dll( vs explorer.exe.0.exe
Source: explorer.exe.0.exe, 00000000.00000003.1858639601.00000232EE885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs explorer.exe.0.exe
Source: classification engineClassification label: mal56.evad.winEXE@4/1028@1/1
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2C77C0 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF75C2C77C0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5332:120:WilError_03
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402Jump to behavior
Source: explorer.exe.0.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\explorer.exe.0.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile read: C:\Users\user\Desktop\explorer.exe.0.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\explorer.exe.0.exe "C:\Users\user\Desktop\explorer.exe.0.exe"
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess created: C:\Users\user\Desktop\explorer.exe.0.exe "C:\Users\user\Desktop\explorer.exe.0.exe"
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess created: C:\Users\user\Desktop\explorer.exe.0.exe "C:\Users\user\Desktop\explorer.exe.0.exe"Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: libffi-7.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: libcrypto-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: libssl-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: mfplat.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: mf.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: mfreadwrite.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: mfcore.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: ksuser.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: rtworkq.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: tcl86t.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: tk86t.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: sqlite3.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
Source: explorer.exe.0.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: explorer.exe.0.exeStatic file information: File size 102917049 > 1048576
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: explorer.exe.0.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: explorer.exe.0.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdbBB source: explorer.exe.0.exe, 00000000.00000003.1857082217.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platformthemes\qxdgdesktopportal.pdb source: explorer.exe.0.exe, 00000000.00000003.1859225522.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: explorer.exe.0.exe, 00000000.00000003.1855721037.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\imageformats\qsvg.pdb source: explorer.exe.0.exe, 00000000.00000003.1856820452.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: explorer.exe.0.exe, 00000000.00000003.1825011333.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\_win32sysloader.pdb source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: explorer.exe.0.exe, 00000000.00000003.1855172965.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtiff.pdb source: explorer.exe.0.exe, 00000000.00000003.1857082217.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qgif.pdb source: explorer.exe.0.exe, 00000000.00000003.1856155264.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ~/.pdbrc source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093124256.0000019694513000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qtga.pdb source: explorer.exe.0.exe, 00000000.00000003.1856920088.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2086176783.000001968D1B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.000001969455E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065663654.000001968D1A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071854636.000001968D1AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068928730.000001968D1AA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: pdb.Pdb source: explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092430348.00000196943D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.00000196943D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.000001969455E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qicns.pdb source: explorer.exe.0.exe, 00000000.00000003.1856310599.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-cpython-39\Release\win32trace.pdb source: explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092430348.00000196943D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.00000196943D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: explorer.exe.0.exe, 00000000.00000003.1856421400.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093124256.0000019694513000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\generic\qtuiotouchplugin.pdb source: explorer.exe.0.exe, 00000000.00000003.1855172965.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: .pdbrc0 source: explorer.exe.0.exe, 00000005.00000002.2095463224.0000019695130000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtimageformats\plugins\imageformats\qwbmp.pdb source: explorer.exe.0.exe, 00000000.00000003.1857260200.00000232EE885000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093124256.0000019694513000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092369096.00000196943C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp
Source: explorer.exe.0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: explorer.exe.0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: explorer.exe.0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: explorer.exe.0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: explorer.exe.0.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext,5_2_70A70C90
Source: explorer.exe.0.exeStatic PE information: section name: _RDATA
Source: opencv_videoio_ffmpeg490_64.dll.0.drStatic PE information: section name: .rodata
Source: opencv_videoio_ffmpeg490_64.dll.0.drStatic PE information: section name: .xdata
Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: .xdata
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /4
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /19
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /31
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /45
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /57
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /70
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /81
Source: libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll.0.drStatic PE information: section name: /92
Source: _portaudio.cp39-win_amd64.pyd.0.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C30510C push rcx; retf 0000h0_2_00007FF75C30510D

Persistence and Installation Behavior

barindex
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d5_2_70A22B90
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d5_2_70A227E0
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess created: "C:\Users\user\Desktop\explorer.exe.0.exe"
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\mtrand.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\core\_multiarray_umath.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\select.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_mt19937.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32pdh.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\python39.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_pcg64.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl86t.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\libffi-7.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\core\_multiarray_tests.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_sfc64.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_bounded_integers.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\pyaudio\_portaudio.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\linalg\_umath_linalg.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2\opencv_videoio_ffmpeg490_64.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\fft\_pocketfft_internal.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\tk86t.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\sqlite3.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_common.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\pywin32_system32\pywintypes39.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_generator.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_philox.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\bit_generator.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\pywin32_system32\pythoncom39.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info\LICENSE.txtJump to behavior

Boot Survival

barindex
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d5_2_70A22B90
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d5_2_70A227E0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2C60F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF75C2C60F0
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_MD5.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\mtrand.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA224.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\core\_multiarray_umath.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_MD4.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\select.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cast.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_ghash_clmul.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_mt19937.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32pdh.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\python39.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA256.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ofb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aes.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aesni.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ocb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_pcg64.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_MD2.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ecb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_RIPEMD160.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\core\_multiarray_tests.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_ARC4.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cbc.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_sfc64.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_bounded_integers.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\pyaudio\_portaudio.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA512.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\linalg\_umath_linalg.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2\opencv_videoio_ffmpeg490_64.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA384.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_SHA1.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_Salsa20.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\fft\_pocketfft_internal.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_BLAKE2s.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_arc2.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_BLAKE2b.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_chacha20.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cfb.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\win32com\shell\shell.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_common.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\pywin32_system32\pywintypes39.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des3.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_generator.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\_philox.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random\bit_generator.cp39-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\win32\win32crypt.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ctr.pydJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67402\pywin32_system32\pythoncom39.dllJump to dropped file
Source: C:\Users\user\Desktop\explorer.exe.0.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-16939
Source: C:\Users\user\Desktop\explorer.exe.0.exeAPI coverage: 3.2 %
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D8110 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF75C2D8110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2C7B80 FindFirstFileExW,FindClose,0_2_00007FF75C2C7B80
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E20D4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF75C2E20D4
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2D8110 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF75C2D8110
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A06A70 GetSystemInfo,VirtualAlloc,VirtualAlloc,5_2_70A06A70
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Temp\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeFile opened: C:\Users\user\AppData\Local\Temp\_MEI67402\Jump to behavior
Source: explorer.exe.0.exe, 00000005.00000002.2086176783.000001968D1B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065663654.000001968D1A9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071854636.000001968D1AB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068928730.000001968D1AA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW

Anti Debugging

barindex
Source: C:\Users\user\Desktop\explorer.exe.0.exeThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2DAE98 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF75C2DAE98
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A70C90 LoadLibraryA,GetProcAddress,GetCurrentThread,RtlWow64SetThreadContext,5_2_70A70C90
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E3CE0 GetProcessHeap,0_2_00007FF75C2E3CE0
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2DAE98 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF75C2DAE98
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2CB1B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF75C2CB1B0
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2CBA5C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF75C2CBA5C
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2CBC04 SetUnhandledExceptionFilter,0_2_00007FF75C2CBC04
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A95380 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,5_2_70A95380

HIPS / PFW / Operating System Protection Evasion

barindex
Source: C:\Users\user\Desktop\explorer.exe.0.exeThread register set: target process: 5332Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeThread register set: target process: 5332Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeThread register set: target process: 5332Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeProcess created: C:\Users\user\Desktop\explorer.exe.0.exe "C:\Users\user\Desktop\explorer.exe.0.exe"Jump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2EA030 cpuid 0_2_00007FF75C2EA030
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\PublicKey VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Util VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PIL VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\bin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\bin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\plugins VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\plugins VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\plugins VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\plugins\imageformats VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\plugins\platforms VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5\Qt5\translations VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\PyQt5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2\misc VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\cv2 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\core VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy\random VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\numpy VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pip-20.2.3.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\setuptools-49.2.1.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl8\8.4 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl8\8.5 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl8 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\encoding VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\http1.0 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\tcl\msgs VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\Desktop\explorer.exe.0.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67402\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2CB940 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF75C2CB940
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 0_2_00007FF75C2E6560 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF75C2E6560
Source: C:\Users\user\Desktop\explorer.exe.0.exeCode function: 5_2_70A70CFC GetVersion,GetCurrentThread,5_2_70A70CFC
Source: C:\Users\user\Desktop\explorer.exe.0.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Native API
1
Bootkit
111
Process Injection
1
Virtualization/Sandbox Evasion
OS Credential Dumping2
System Time Discovery
Remote Services1
Archive Collected Data
22
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading
1
DLL Side-Loading
111
Process Injection
LSASS Memory121
Security Software Discovery
Remote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information
Security Account Manager1
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared Drive2
Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information
NTDS2
File and Directory Discovery
Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Bootkit
LSA Secrets25
System Information Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading
Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
No Antivirus matches
SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_ARC4.pyd3%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_Salsa20.pyd4%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_chacha20.pyd3%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_pkcs1_decode.pyd3%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aes.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_aesni.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_arc2.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_blowfish.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cast.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cbc.pyd4%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_cfb.pyd3%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ctr.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des.pyd3%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_des3.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ecb.pyd3%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_eksblowfish.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ocb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ocb.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ofb.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_raw_ofb.pyd4%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_BLAKE2b.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Hash\_BLAKE2b.pyd1%VirustotalBrowse
No Antivirus matches
SourceDetectionScannerLabelLink
bg.microsoft.map.fastly.net0%VirustotalBrowse
fp2e7a.wpc.phicdn.net0%VirustotalBrowse
SourceDetectionScannerLabelLink
http://crl.dhimyotis.com/certignarootca.crl0%URL Reputationsafe
http://crl.dhimyotis.com/certignarootca.crl0%URL Reputationsafe
https://wwww.certigna.fr/autorites/0m0%URL Reputationsafe
https://wwww.certigna.fr/autorites/0m0%URL Reputationsafe
https://wwww.certigna.fr/autorites/0%URL Reputationsafe
http://crl.securetrust.com/STCA.crl0%URL Reputationsafe
http://crl.xrampsecurity.com/XGCA.crl00%URL Reputationsafe
http://www.accv.es000%URL Reputationsafe
http://crl.certigna.fr/certign0%Avira URL Cloudsafe
http://crl.dhimyotis.com/certignarootca.crlLL0%Avira URL Cloudsafe
https://dmlc.github.io/dlpack/latest/python_spec.html0%Avira URL Cloudsafe
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html0%Avira URL Cloudsafe
http://crl.xrampsecurity.com/XGCA.crl90%Avira URL Cloudsafe
https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
http://www.inference.org.uk/mackay/itila/0%Avira URL Cloudsafe
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html0%VirustotalBrowse
https://dmlc.github.io/dlpack/latest/python_spec.html0%VirustotalBrowse
http://www.inference.org.uk/mackay/itila/0%VirustotalBrowse
http://crl.xrampsecurity.com/XGCA.crl90%VirustotalBrowse
http://crl.certigna.fr/certign0%VirustotalBrowse
http://crl.dhimyotis.com/certignarootca.crlLL0%VirustotalBrowse
NameIPActiveMaliciousAntivirus DetectionReputation
bg.microsoft.map.fastly.net
199.232.210.172
truefalseunknown
drive.usercontent.google.com
172.217.4.65
truefalse
    high
    fp2e7a.wpc.phicdn.net
    192.229.211.108
    truefalseunknown
    NameSourceMaliciousAntivirus DetectionReputation
    https://github.com/asweigart/pyperclip/issues/55explorer.exe.0.exe, 00000005.00000002.2095655684.0000019695230000.00000004.00001000.00020000.00000000.sdmpfalse
      high
      https://github.com/joblib/threadpoolctlexplorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066441487.000001968DA26000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmpfalse
        high
        https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdfexplorer.exe.0.exe, 00000005.00000003.2074868149.000001969469B000.00000004.00000020.00020000.00000000.sdmpfalse
          high
          https://numpy.org/devdocs/release/1.20.0-notes.html#deprecationsexplorer.exe.0.exe, 00000005.00000003.2029602643.000001968D219000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmpfalse
            high
            http://www.scipy.org/not/real/data.txtexplorer.exe.0.exe, 00000005.00000003.2065449391.000001968D78D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D775000.00000004.00000020.00020000.00000000.sdmpfalse
              high
              http://www.dabeaz.com/ply)explorer.exe.0.exe, 00000005.00000003.2078173062.0000019695740000.00000004.00001000.00020000.00000000.sdmpfalse
                high
                https://docs.scipy.org/doc/numpy/user/basics.io.genfromtxt.htmlexplorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DAB7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064620989.000001968DAB4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmpfalse
                  high
                  https://github.com/arogozhnikov/einopsexplorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065636498.000001968D9DD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066648460.000001968D9DE000.00000004.00000020.00020000.00000000.sdmpfalse
                    high
                    http://aka.ms/vcpython27explorer.exe.0.exe, 00000005.00000002.2090915252.000001968DCE0000.00000004.00001000.00020000.00000000.sdmpfalse
                      high
                      https://cloud.google.com/appengine/docs/standard/runtimesexplorer.exe.0.exe, 00000005.00000002.2095762637.00000196952E0000.00000004.00001000.00020000.00000000.sdmpfalse
                        high
                        https://docs.python.org/library/string.html#format-specification-mini-languageexplorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA87000.00000004.00000020.00020000.00000000.sdmpfalse
                          high
                          http://crl.certigna.fr/certignexplorer.exe.0.exe, 00000005.00000003.2060335185.000001969490E000.00000004.00000020.00020000.00000000.sdmpfalse
                          • 0%, Virustotal, Browse
                          • Avira URL Cloud: safe
                          unknown
                          https://github.com/mhammond/pywin32explorer.exe.0.exe, 00000000.00000002.2104401773.00000232EE88A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE86F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103666296.00000232EE8BB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103694052.00000232EE888000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000000.00000003.2103566333.00000232EE8BA000.00000004.00000020.00020000.00000000.sdmpfalse
                            high
                            https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.aspexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpfalse
                              high
                              http://mathworld.wolfram.com/NoncentralF-Distribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpfalse
                                high
                                http://www.doi.org/10.1109/IEEESTD.2008.4610935explorer.exe.0.exe, 00000005.00000003.2065012584.000001968D9D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067422614.000001968D9D9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2089778901.000001968D9DA000.00000004.00000020.00020000.00000000.sdmpfalse
                                  high
                                  https://www.python.org/dev/peps/pep-0506/explorer.exe.0.exe, 00000005.00000002.2091746203.00000196942D0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    high
                                    https://gist.github.com/imneme/540829265469e673d045explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpfalse
                                      high
                                      http://repository.swisssign.com/0explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        high
                                        http://docs.python.org/library/unittest.htmlexplorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077545050.000001969455E000.00000004.00000020.00020000.00000000.sdmpfalse
                                          high
                                          http://repository.swisssign.com/qy6-explorer.exe.0.exe, 00000005.00000003.2077125931.0000019694659000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076504779.0000019694651000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075858126.000001969464C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062148512.0000019694644000.00000004.00000020.00020000.00000000.sdmpfalse
                                            high
                                            https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#explorer.exe.0.exe, 00000005.00000002.2084190766.000001968AF83000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063844993.000001968AF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074671812.000001968AF82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              high
                                              http://www.python.org/download/releases/2.3/mro/.explorer.exe.0.exe, 00000005.00000003.2013406270.000001968CEE1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2085414679.000001968CFD0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2013691427.000001968CEED000.00000004.00000020.00020000.00000000.sdmpfalse
                                                high
                                                http://crl.dhimyotis.com/certignarootca.crlLLexplorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                unknown
                                                https://tools.ietf.org/html/rfc2388#section-4.4explorer.exe.0.exe, 00000005.00000003.2062290322.00000196943BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092430348.00000196943D3000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.00000196943D2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062714316.00000196943CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  high
                                                  https://dmlc.github.io/dlpack/latest/python_spec.htmlexplorer.exe.0.exe, 00000005.00000003.2066579767.000001968D9B5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2089696281.000001968D9B9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065160675.000001968D998000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064899597.000001968D997000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067484924.000001968D9B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  unknown
                                                  http://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular-explorer.exe.0.exe, 00000005.00000003.2063033484.000001968D757000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2016710838.000001968D2AE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2016780116.000001968D721000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2088278179.000001968D759000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    high
                                                    https://github.com/pypa/packagingexplorer.exe.0.exe, 00000005.00000002.2087791858.000001968D5D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090827906.000001968DC60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      high
                                                      http://www.opensource.org/licenses/mit-license.phpexplorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        high
                                                        https://personal.math.ubc.ca/~cbm/aands/page_379.htmexplorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          high
                                                          http://mathworld.wolfram.com/LaplaceDistribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            high
                                                            https://ipython.orgexplorer.exe.0.exe, 00000005.00000002.2089128924.000001968D96A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              high
                                                              https://tools.ietf.org/html/rfc3610explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069084888.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078797208.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071943201.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093942934.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077220802.0000019694793000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                high
                                                                http://crl.dhimyotis.com/certignarootca.crlexplorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • URL Reputation: safe
                                                                • URL Reputation: safe
                                                                unknown
                                                                http://curl.haxx.se/rfc/cookie_spec.htmlexplorer.exe.0.exe, 00000005.00000002.2096096049.0000019695400000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  high
                                                                  http://ocsp.accv.esexplorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    high
                                                                    http://www.python.org/dev/peps/pep-0205/explorer.exe.0.exe, 00000005.00000002.2087486863.000001968D460000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      high
                                                                      https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-cexplorer.exe.0.exe, 00000005.00000002.2095380939.0000019695060000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        high
                                                                        https://personal.math.ubc.ca/~cbm/aands/page_67.htmexplorer.exe.0.exe, 00000005.00000003.2062487541.00000196943B3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          high
                                                                          http://arxiv.org/abs/1805.10941.explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            high
                                                                            http://json.orgexplorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              high
                                                                              https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688explorer.exe.0.exe, 00000005.00000002.2084447686.000001968C7B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                high
                                                                                https://httpbin.org/getexplorer.exe.0.exe, 00000005.00000002.2095842696.0000019695320000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  high
                                                                                  http://httpbin.org/explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    high
                                                                                    https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htmexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063628213.0000019694329000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068720582.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067505616.000001969432D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091896473.000001969432E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      https://www.youtube.com/c/NeuralNineexplorer.exe.0.exe, 00000005.00000002.2091283468.000001968E010000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        high
                                                                                        https://github.com/python-pillow/Pillow/explorer.exe.0.exe, 00000005.00000002.2095271886.0000019694FD0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          http://mathworld.wolfram.com/NegativeBinomialDistribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            https://pypi.org/project/numpy-financial0yexplorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              high
                                                                                              https://github.com/pypa/packagingEI67402explorer.exe.0.exe, 00000005.00000002.2087791858.000001968D5D0000.00000004.00001000.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090827906.000001968DC60000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                high
                                                                                                https://pypi.org/project/numpy-financial0zexplorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  high
                                                                                                  https://pypi.org/project/numpy-financial0wexplorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    https://pypi.org/project/numpy-financial0xexplorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      high
                                                                                                      https://wwww.certigna.fr/autorites/0mexplorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      • URL Reputation: safe
                                                                                                      unknown
                                                                                                      https://pypi.org/project/numpy-financial0uexplorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        high
                                                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerexplorer.exe.0.exe, 00000005.00000002.2084190766.000001968AF83000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063844993.000001968AF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074671812.000001968AF82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          high
                                                                                                          https://pypi.org/project/numpy-financial0vexplorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            high
                                                                                                            https://docs.scipy.org/doc/numpy/user/numpy-for-matlab-users.html).explorer.exe.0.exe, 00000005.00000002.2091534482.0000019694190000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              high
                                                                                                              https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdfexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                high
                                                                                                                http://mail.python.org/pipermail/python-dev/2012-June/120787.html.explorer.exe.0.exe, 00000005.00000002.2096162760.0000019695440000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  high
                                                                                                                  http://repository.swisssign.com/mexplorer.exe.0.exe, 00000005.00000003.2060864313.000001969479F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061547086.00000196947B7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    high
                                                                                                                    https://httpbin.org/explorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      high
                                                                                                                      http://www.ams.org/journals/mcom/1988-51-184/explorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        high
                                                                                                                        https://numpy.org/doc/stable/reference/random/index.htmlexplorer.exe.0.exe, 00000005.00000002.2091701305.0000019694290000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          high
                                                                                                                          https://wwww.certigna.fr/autorites/explorer.exe.0.exe, 00000005.00000003.2060398051.00000196948F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • URL Reputation: safe
                                                                                                                          unknown
                                                                                                                          http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • 0%, Virustotal, Browse
                                                                                                                          • Avira URL Cloud: safe
                                                                                                                          unknown
                                                                                                                          https://metacpan.org/pod/distribution/Math-Cephes/lib/Math/Cephes.pod#i0:-Modified-Bessel-function-oexplorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            high
                                                                                                                            http://crl.xrampsecurity.com/XGCA.crl9explorer.exe.0.exe, 00000005.00000003.2070306490.000001968CF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069682618.000001968CF67000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076777661.000001968CF80000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063653360.000001968CF66000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • 0%, Virustotal, Browse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            unknown
                                                                                                                            https://github.com/numpy/numpy/issues/4763explorer.exe.0.exe, 00000005.00000002.2094864024.0000019694B10000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              high
                                                                                                                              http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535explorer.exe.0.exe, 00000005.00000003.2070370911.00000196945C2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                high
                                                                                                                                https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syexplorer.exe.0.exe, 00000005.00000002.2084190766.000001968AF83000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063844993.000001968AF7E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074671812.000001968AF82000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.aspexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    high
                                                                                                                                    http://mathworld.wolfram.com/CauchyDistribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      high
                                                                                                                                      http://mathworld.wolfram.com/HypergeometricDistribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://github.com/pypa/setuptools/issues/417#issuecomment-392298401explorer.exe.0.exe, 00000005.00000002.2090578446.000001968DB20000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          high
                                                                                                                                          http://mathworld.wolfram.com/PoissonDistribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068623564.000001969433B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091974156.000001969433D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063402348.000001969433A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            high
                                                                                                                                            http://mathworld.wolfram.com/SincFunction.htmlexplorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              high
                                                                                                                                              https://setuptools.readthedocs.io/en/latest/pkg_resources.html#basic-resource-accessexplorer.exe.0.exe, 00000005.00000003.2015865397.000001968D14A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063286754.000001968D18B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                high
                                                                                                                                                http://github.com/ActiveState/appdirsexplorer.exe.0.exe, 00000005.00000002.2087752969.000001968D590000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://wiki.debian.org/XDGBaseDirectorySpecification#stateexplorer.exe.0.exe, 00000005.00000002.2084829520.000001968CEB8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070616430.000001968CEB7000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065077852.000001968CEAB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    http://crl.securetrust.com/STCA.crlexplorer.exe.0.exe, 00000005.00000002.2094784332.0000019694980000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    • URL Reputation: safe
                                                                                                                                                    unknown
                                                                                                                                                    http://wwwsearch.sf.net/):explorer.exe.0.exe, 00000005.00000003.2070779912.00000196945BC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2072594031.00000196945BD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075961660.00000196945BF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        http://www.accv.es/legislacion_c.htmexplorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          https://upload.pypi.org/legacy/0explorer.exe.0.exe, 00000005.00000002.2090740273.000001968DBE0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            high
                                                                                                                                                            http://crl.xrampsecurity.com/XGCA.crl0explorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093057347.00000196944FD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                            unknown
                                                                                                                                                            http://www.cert.fnmt.es/dpcs/explorer.exe.0.exe, 00000005.00000003.2061449551.0000019694796000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-moduleexplorer.exe.0.exe, 00000005.00000003.2079255077.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068173074.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                high
                                                                                                                                                                http://www.accv.es00explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946B1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067852194.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061062319.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2062188784.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2075521525.00000196945F5000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093551689.000001969460A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2074375741.00000196946B0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078898259.00000196945F9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                unknown
                                                                                                                                                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyexplorer.exe.0.exe, 00000005.00000003.2014120399.000001968AF7E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  high
                                                                                                                                                                  http://www.rfc-editor.org/info/rfc7253explorer.exe.0.exe, 00000005.00000003.2074868149.00000196946EF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.000001969470C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2073202622.00000196946EC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069286740.00000196946CD000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2076574226.0000019694709000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    https://pypi.org/project/numpy-financial0explorer.exe.0.exe, 00000005.00000002.2094948690.0000019694B90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      high
                                                                                                                                                                      https://web.archive.org/web/20080221202153/https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdfexplorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        http://bugs.python.org/issue23606)explorer.exe.0.exe, 00000005.00000002.2095422757.00000196950A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          high
                                                                                                                                                                          http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdfexplorer.exe.0.exe, 00000005.00000003.2064870767.000001968DA85000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078528197.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2069084888.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2078797208.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2071943201.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093942934.0000019694793000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2077220802.0000019694793000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            http://google.com/explorer.exe.0.exe, 00000005.00000003.2061062319.00000196944FA000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067575943.000001968DA96000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065836329.000001968DA8C000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068499505.00000196945AC000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068459540.000001969458D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2093185446.0000019694559000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070904617.0000019694423000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066705709.0000019694589000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068802627.0000019694408000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064986135.000001968DA8A000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2080021280.000001969450F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070822573.000001968DAA7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              https://mahler:8092/site-updates.pyexplorer.exe.0.exe, 00000005.00000003.2063449734.000001968D7F0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2060426210.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2061879407.000001968D7E1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2070399264.000001968D82E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                                              low
                                                                                                                                                                              https://numpy.org/devdocs/release/1.20.0-notes.html#deprecationsqexplorer.exe.0.exe, 00000005.00000003.2066302421.000001968DAE2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090508419.000001968DAFE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2066394255.000001968DAF1000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2064528527.000001968DAC6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063728587.000001968DABE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                high
                                                                                                                                                                                http://www.inference.org.uk/mackay/itila/explorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063123348.000001968DB06000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2090549950.000001968DB12000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2065951841.000001968DB08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                • 0%, Virustotal, Browse
                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                unknown
                                                                                                                                                                                http://mathworld.wolfram.com/BinomialDistribution.htmlexplorer.exe.0.exe, 00000005.00000003.2063176582.0000019694313000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068278905.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063226889.0000019694353000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068530628.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2063628213.0000019694329000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2068720582.000001969432E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000003.2067505616.000001969432D000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2092034107.0000019694355000.00000004.00000020.00020000.00000000.sdmp, explorer.exe.0.exe, 00000005.00000002.2091896473.000001969432E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  high
                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                  • 75% < No. of IPs
                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                  172.217.4.65
                                                                                                                                                                                  drive.usercontent.google.comUnited States
                                                                                                                                                                                  15169GOOGLEUSfalse
                                                                                                                                                                                  Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                  Analysis ID:1439468
                                                                                                                                                                                  Start date and time:2024-05-10 11:10:11 +02:00
                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                  Overall analysis duration:0h 7m 2s
                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                  Report type:full
                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                  Number of analysed new started processes analysed:6
                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                  Technologies:
                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                  Sample name:explorer.exe.0.exe
                                                                                                                                                                                  (renamed file extension from dr to exe)
                                                                                                                                                                                  Original Sample Name:explorer.exe.0.dr
                                                                                                                                                                                  Detection:MAL
                                                                                                                                                                                  Classification:mal56.evad.winEXE@4/1028@1/1
                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                                                  HCA Information:
                                                                                                                                                                                  • Successful, ratio: 99%
                                                                                                                                                                                  • Number of executed functions: 52
                                                                                                                                                                                  • Number of non-executed functions: 143
                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                  • Stop behavior analysis, all processes terminated
                                                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 40.126.28.14, 40.126.28.19, 40.126.28.12, 40.126.28.23, 40.126.28.20, 40.126.28.22, 40.126.28.11, 40.126.7.35, 20.189.173.21
                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, www.tm.lg.prod.aadmsa.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net
                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                  No simulations
                                                                                                                                                                                  No context
                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  fp2e7a.wpc.phicdn.netInvoice.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  http://omnatuor.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  http://eurovisionsongcontest.nlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  http://premierpointmortgage.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  http://rest.cdntoswitchspirit.com/scripts/stack.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  https://www.xtransfer.cn/unsubscribe?p=1kpU6P0NN-6RM7EO4H_1kpU72q8p-6PSUvf2pGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  https://apphu7bh2.z19.web.core.windows.net/Win0security-helpline07/index.html?ph0n=1-866-993-2498Get hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  https://smbjxijw.com/login.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  https://smbjxbbf.com/login.phpGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  https://tron2qu8g.z13.web.core.windows.net/Apple0s01Ersys44/index.htmlGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                  • 192.229.211.108
                                                                                                                                                                                  bg.microsoft.map.fastly.netPepsico LLC Company Profile.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.210.172
                                                                                                                                                                                  INQUIRY#46789-MAY562024.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.210.172
                                                                                                                                                                                  55678_70USD.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.214.172
                                                                                                                                                                                  F098765434568999B.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.214.172
                                                                                                                                                                                  INVOICE087667899.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.210.172
                                                                                                                                                                                  Order no 6543221.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                  • 199.232.214.172
                                                                                                                                                                                  http://omnatuor.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.214.172
                                                                                                                                                                                  http://eurovisionsongcontest.nlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.214.172
                                                                                                                                                                                  OR20240905662201.jsGet hashmaliciousSTRRATBrowse
                                                                                                                                                                                  • 199.232.210.172
                                                                                                                                                                                  http://premierpointmortgage.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                  • 199.232.214.172
                                                                                                                                                                                  No context
                                                                                                                                                                                  No context
                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_ARC4.pyd00#U2800.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                    prank.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                      SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                        SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                            MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                  SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                    SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\_MEI67402\Crypto\Cipher\_Salsa20.pyd00#U2800.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        prank.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                                          SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            SecuriteInfo.com.FileRepMalware.5539.23420.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                                                MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zipGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                    SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                      SecuriteInfo.com.FileRepMalware.7114.13860.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                        SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11264
                                                                                                                                                                                                                          Entropy (8bit):4.6989965032233245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:v9VD9daQ2iTrqT+y/ThvQ0I1uLfcC75JiC4Rs89EcYyGDPM0OcX6gY/7ECFV:39damqT3ThITst0E5DPKcqgY/79X
                                                                                                                                                                                                                          MD5:56976443600793FF2302EE7634E496B3
                                                                                                                                                                                                                          SHA1:018CE9250732A1794BBD0BDB8164061022B067AA
                                                                                                                                                                                                                          SHA-256:10F461A94C3D616C19FF1A88DEC1EFEA5194F7150F5D490B38AC4E1B31F673DD
                                                                                                                                                                                                                          SHA-512:A764C636D5D0B878B91DC61485E8699D7AA36F09AA1F0BD6AF33A8652098F28AEB3D7055008E56EBFC012BD3EA0868242A72E44DED0C83926F13D16866C31415
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: 00#U2800.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: prank.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.047528837102683
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:SF/1nb2eqCQtkluknuz4ceS4QDuEA7cqgYvEP:o2P6luLtn4QDHmgYvEP
                                                                                                                                                                                                                          MD5:30F13366926DDC878B6D761BEC41879E
                                                                                                                                                                                                                          SHA1:4B98075CCBF72A6CBF882B6C5CADEF8DC6EC91DB
                                                                                                                                                                                                                          SHA-256:19D5F8081552A8AAFE901601D1FF5C054869308CEF92D03BCBE7BD2BB1291F23
                                                                                                                                                                                                                          SHA-512:BDCEC85915AB6EC1D37C1D36B075AE2E69AA638B80CD08971D5FDFD9474B4D1CF442ABF8E93AA991F5A8DCF6DB9D79FB67A9FE7148581E6910D9C952A5E166B4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 4%, Browse
                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                          • Filename: 00#U2800.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: prank.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.5539.23420.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.MacOS.ReverseShell-C.30585.8425.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: MDE_File_Sample_1e64554c1e3e257c1c52d34ca908eb9958a6bbf7.zip, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.FileRepMalware.7114.13860.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          • Filename: SecuriteInfo.com.W64.ABRisk.PVEG-3846.30817.29399.exe, Detection: malicious, Browse
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..L............p..,....3...............................1..@............0...............................text...h........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13312
                                                                                                                                                                                                                          Entropy (8bit):5.0513840905718395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:7XF/1nb2eqCQtkXnFYIrWjz0YgWDbu5Do0vdvZt49lkVcqgYvEMN:L2P6XTr0zXgWDbui0vdvZt49MgYvEMN
                                                                                                                                                                                                                          MD5:CDF7D583B5C0150455BD3DAD43A6BF9B
                                                                                                                                                                                                                          SHA1:9EE9B033892BEB0E9641A67F456975A78122E4FA
                                                                                                                                                                                                                          SHA-256:4CA725A1CB10672EE5666ED2B18E926CAAE1A8D8722C14AB3BE2D84BABF646F6
                                                                                                                                                                                                                          SHA-512:96123559D21A61B144E2989F96F16786C4E94E5FA4DDA0C018EAA7FEFFA61DD6F0ADFA9815DF9D224CDEBE2E7849376D2A79D5A0F51A7F3327A2FAA0A444CE9C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12800
                                                                                                                                                                                                                          Entropy (8bit):5.1050594710160535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:/PTF1siKeai1dqmJo0qVVLf/+NJSC6sc9kJ9oPobXXXP4IIYOxDmO8jcX6gRth2h:/LsiHfq5poUkJ97zIDmOucqgRvE
                                                                                                                                                                                                                          MD5:7918BFE07DCB7AD21822DBAAA777566D
                                                                                                                                                                                                                          SHA1:964F5B172759538C4E9E9131CE4BB39885D79842
                                                                                                                                                                                                                          SHA-256:C00840D02ADA7031D294B1AB94A5F630C813AAE6897F18DD66C731F56931868E
                                                                                                                                                                                                                          SHA-512:D4A05AB632D4F0EB0ED505D803F6A5C0DBE5117D12BA001CE820674903209F7249B690618555F9C061DB58BED1E03BE58AD5D5FE3BC35FC96DF27635639ABF25
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                          Reputation:moderate, very likely benign file
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............l...l...l......l.q.m...l..m...l...m...l.q.i...l.q.h...l.q.o...l...d...l...l...l.......l...n...l.Rich..l.................PE..d....y.e.........." ...#............P.....................................................`.........................................P8..p....8..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......*..............@....pdata.......P.......,..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):36352
                                                                                                                                                                                                                          Entropy (8bit):6.55587798283519
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:Of+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuTLg4HPy:WqWB7YJlmLJ3oD/S4j990th9VTsC
                                                                                                                                                                                                                          MD5:4B032DA3C65EA0CFBDEB8610C4298C51
                                                                                                                                                                                                                          SHA1:541F9F8D428F4518F96D44BB1037BC348EAE54CF
                                                                                                                                                                                                                          SHA-256:4AEF77E1359439748E6D3DB1ADB531CF86F4E1A8E437CCD06E8414E83CA28900
                                                                                                                                                                                                                          SHA-512:2667BF25FD3BF81374750B43AFC5AEFF839EC1FF6DFC3FDD662F1D34A5924F69FC513EA3CD310991F85902A19ADA8B58DED9A9ED7B5D631563F62EA7F2624102
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15872
                                                                                                                                                                                                                          Entropy (8bit):5.2919328525651945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:oJBjJPqZkEPYinXKccxrEWx4xLquhS3WQ67EIfD4A1ccqgwYUMvEW:6URwin7mrEYCLEGd7/fDnwgwYUMvE
                                                                                                                                                                                                                          MD5:57E4DF965E41B1F385B02F00EA08AE20
                                                                                                                                                                                                                          SHA1:583B08C3FC312C8943FECDDD67D6D0A5FC2FF98B
                                                                                                                                                                                                                          SHA-256:3F64DFFEC486DCF9A2E80CB9D96251B98F08795D5922D43FB69F0A5AC2340FC2
                                                                                                                                                                                                                          SHA-512:48C3F78AF4E35BFEF3B0023A8039CF83E6B2E496845A11B7A2C2FA8BB62C7CCDE52158D4D37755584716220C34BBF379ECE7F8E3439B009AD099B1890B42A3D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|X...................i.......................i.......i.......i.......................................Rich....................PE..d....y.e.........." ...#. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16384
                                                                                                                                                                                                                          Entropy (8bit):5.565187477275172
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:MeDd9Vk3yQ5f8vjVKChhXoJDkq6NS7oE2DDHlWw2XpmdcqgwNeecBU8:1k/5cj4shXED+o2Du8zgwNeO8
                                                                                                                                                                                                                          MD5:F9C93FA6CA17FDF4FF2F13176684FD6C
                                                                                                                                                                                                                          SHA1:6B6422B4CAF157147F7C0DD4B4BAB2374BE31502
                                                                                                                                                                                                                          SHA-256:E9AEBB6F17BA05603E0763DFF1A91CE9D175C61C1C2E80F0881A0DEE8CFFBE3A
                                                                                                                                                                                                                          SHA-512:09843E40E0D861A2DEE97320779C603550433BC9AB9402052EA284C6C74909E17CE0F6D3FDBA983F5EB6E120E2FE0C2B087420E138760BB0716D2999C10935C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20992
                                                                                                                                                                                                                          Entropy (8bit):6.058843128972375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:fHU/5cJMOZA0nmwBD+XpJgLa0Mp8Qhg4P2llyM:QK1XBD+DgLa1qTi
                                                                                                                                                                                                                          MD5:E4969D864420FEB94F54CEF173D0AD4D
                                                                                                                                                                                                                          SHA1:7F8FE4225BB6FD37F84EBCE8E64DF7192BA50FB6
                                                                                                                                                                                                                          SHA-256:94D7D7B43E58170CAEA4520D7F741D743BC82B59BE50AA37D3D2FB7B8F1BB061
                                                                                                                                                                                                                          SHA-512:F02F02A7DE647DDA723A344DBB043B75DA54D0783AE13E5D25EEC83072EA3B2375F672B710D6348D9FC829E30F8313FA44D5C28B4D65FDA8BB863700CAE994B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):25088
                                                                                                                                                                                                                          Entropy (8bit):6.458942954966616
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:xVcaHLHm+kJ7ZXmrfXA+UA10ol31tuXyZQ7gLWi:8aHrm+kJNXmrXA+NNxWi28LWi
                                                                                                                                                                                                                          MD5:CD4B96612DEFDAAC5CF923A3960F15B6
                                                                                                                                                                                                                          SHA1:3F987086C05A4246D8CCA9A65E42523440C7FFEC
                                                                                                                                                                                                                          SHA-256:5C25283C95FFF9B0E81FCC76614626EB8048EA3B3FD1CD89FE7E2689130E0447
                                                                                                                                                                                                                          SHA-512:C650860A3ECC852A25839FF1E379526157EB79D4F158B361C90077875B757F5E7A4AA33FFE5F4F49B28DF5D60E3471370889FBE3BF4D9568474ECE511FF5E67D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....".......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.833693880012467
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:BF/1nb2eqCQtkrAUj8OxKbDbzecqgYvEkrK:t2P6EE8OsbD2gYvEmK
                                                                                                                                                                                                                          MD5:0C46D7B7CD00B3D474417DE5D6229C41
                                                                                                                                                                                                                          SHA1:825BDB1EA8BBFE7DE69487B76ABB36196B5FDAC0
                                                                                                                                                                                                                          SHA-256:9D0A5C9813AD6BA129CAFEF815741636336EB9426AC4204DE7BC0471F7B006E1
                                                                                                                                                                                                                          SHA-512:D81B17B100A052899D1FD4F8CEA1B1919F907DAA52F1BAD8DC8E3F5AFC230A5BCA465BBAC2E45960E7F8072E51FDD86C00416D06CF2A1F07DB5AD8A4E3930864
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 4%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):4.900216636767426
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:YTI1RgPfqLlvIOP3bdS2hkPUDk9oCM/vPXcqgzQkvEmO:YTvYgAdDkUDDCWpgzQkvE
                                                                                                                                                                                                                          MD5:3142C93A6D9393F071AB489478E16B86
                                                                                                                                                                                                                          SHA1:4FE99C817ED3BCC7708A6631F100862EBDA2B33D
                                                                                                                                                                                                                          SHA-256:5EA310E0F85316C8981ED6293086A952FA91A6D12CA3F8AF9581521EE2B15586
                                                                                                                                                                                                                          SHA-512:DCAFEC54BD9F9F42042E6FA4AC5ED53FEB6CF8D56ADA6A1787CAFC3736AA72F14912BBD1B27D0AF87E79A6D406B0326602ECD1AD394ACDC6275AED4C41CDB9EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................?.....q......................q.......q.......q.........................S.............Rich............PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.302400096950382
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:SJ1gSPqgKkwv0i8NSixSK57NEEE/qexcEtDr+DjRcqgUF6+6vEX:6E1si8NSixS0CqebtD+rgUUjvE
                                                                                                                                                                                                                          MD5:A34F499EE5F1B69FC4FED692A5AFD3D6
                                                                                                                                                                                                                          SHA1:6A37A35D4F5F772DAB18E1C2A51BE756DF16319A
                                                                                                                                                                                                                          SHA-256:4F74BCF6CC81BAC37EA24CB1EF0B17F26B23EDB77F605531857EAA7B07D6C8B2
                                                                                                                                                                                                                          SHA-512:301F7C31DEE8FF65BB11196F255122E47F3F1B6B592C86B6EC51AB7D9AC8926FECFBE274679AD4F383199378E47482B2DB707E09D73692BEE5E4EC79C244E3A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,......,.q.-...,..-...,...-...,.q.)...,.q.(...,.q./...,...$...,...,...,.......,.......,.Rich..,.................PE..d....y.e.........." ...#..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):57856
                                                                                                                                                                                                                          Entropy (8bit):4.25844209931351
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:1UqVT1dZ/lHkJnYcZiGKdZHDLtiduprZAZB0JAIg+v:nHlHfJid3X
                                                                                                                                                                                                                          MD5:007BE822C3657687A84A7596531D79B7
                                                                                                                                                                                                                          SHA1:B24F74FDC6FA04EB7C4D1CD7C757C8F1C08D4674
                                                                                                                                                                                                                          SHA-256:6CF2B3969E44C88B34FB145166ACCCDE02B53B46949A9D5C37D83CA9C921B8C8
                                                                                                                                                                                                                          SHA-512:F9A8B070302BDFE39D0CD8D3E779BB16C9278AE207F5FADF5B27E1A69C088EEF272BFBCE6B977BA37F68183C8BBEAC7A31668662178EFE4DF8940E19FBCD9909
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58368
                                                                                                                                                                                                                          Entropy (8bit):4.274890605099198
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:4Uqho9weF5/dHkRnYcZiGKdZHDL7idErZBZYmGg:ECndH//iduz
                                                                                                                                                                                                                          MD5:A883798D95F76DA8513DA6B87D470A2A
                                                                                                                                                                                                                          SHA1:0507D920C1935CE71461CA1982CDB8077DDB3413
                                                                                                                                                                                                                          SHA-256:AED194DD10B1B68493481E7E89F0B088EF216AB5DB81959A94D14BB134643BFB
                                                                                                                                                                                                                          SHA-512:5C65221542B3849CDFBC719A54678BB414E71DE4320196D608E363EFF69F2448520E620B5AA8398592D5B58D7F7EC1CC4C72652AD621308C398D45F294D05C9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..n...n...n......n.q.o...n...o...n...o...n.q.k...n.q.j...n.q.m...n...f...n...n...n.......n...l...n.Rich..n.........PE..d....y.e.........." ...#.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10752
                                                                                                                                                                                                                          Entropy (8bit):4.5811635662773185
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:PzWVddiTHThQTctEEI4qXDc1CkcqgbW6:PzWMdsc+EuXDc0YgbW
                                                                                                                                                                                                                          MD5:DEDAE3EFDA452BAB95F69CAE7AEBB409
                                                                                                                                                                                                                          SHA1:520F3D02693D7013EA60D51A605212EFED9CA46B
                                                                                                                                                                                                                          SHA-256:6248FDF98F949D87D52232DDF61FADA5EF02CD3E404BB222D7541A84A3B07B8A
                                                                                                                                                                                                                          SHA-512:8C1CAB8F34DE2623A42F0750F182B6B9A7E2AFFA2667912B3660AF620C7D9AD3BD5B46867B3C2D50C0CAE2A1BC03D03E20E4020B7BA0F313B6A599726F022C6C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&4%.bUK.bUK.bUK.k-..`UK..)J.`UK.)-J.aUK.bUJ.AUK..)N.iUK..)O.jUK..)H.aUK.(C.cUK.(K.cUK.(..cUK.(I.cUK.RichbUK.........PE..d....y.e.........." ...#............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22016
                                                                                                                                                                                                                          Entropy (8bit):6.1405490084747445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:WMU/5cRUtPMbNv37t6KjjNrDF6pJgLa0Mp8Qg0gYP2lcCM:WdKR8EbxwKflDFQgLa1AzP
                                                                                                                                                                                                                          MD5:914EA1707EBA03E4BE45D3662BF2466E
                                                                                                                                                                                                                          SHA1:3E110C9DBFE1D17E1B4BE69052E65C93DDC0BF26
                                                                                                                                                                                                                          SHA-256:4D4F22633D5DB0AF58EE260B5233D48B54A6F531FFD58EE98A5305E37A00D376
                                                                                                                                                                                                                          SHA-512:F6E6323655B351E5B7157231E04C352A488B0B49D7174855FC8594F119C87A26D31C602B3307C587A28AD408C2909A93B8BA8CB41166D0113BD5C6710C4162C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17920
                                                                                                                                                                                                                          Entropy (8bit):5.350740516564008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:GPHdP3Mj7Be/yB/MsB3yRcb+IqcOYoQViCBD88g6Vf4A:APcnB8KEsB3ocb+pcOYLMCBDu
                                                                                                                                                                                                                          MD5:52E481A15C3CE1B0DF8BA3B1B77DF9D0
                                                                                                                                                                                                                          SHA1:C1F06E1E956DFDE0F89C2E237ADFE42075AAE954
                                                                                                                                                                                                                          SHA-256:C85A6783557D96BFA6E49FE2F6EA4D2450CF110DA314C6B8DCEDD7590046879B
                                                                                                                                                                                                                          SHA-512:108FB1344347F0BC27B4D02D3F4E75A76E44DE26EF54323CB2737604DF8860A94FA37121623A627937F452B3B923C3D9671B13102D2E5F1005E4766E80A05A96
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d....y.e.........." ...#.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12288
                                                                                                                                                                                                                          Entropy (8bit):4.737329240938157
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:BF/1nb2eqCQtkgU7L9D0T70fcqgYvEJPb:t2P6L9DWAxgYvEJj
                                                                                                                                                                                                                          MD5:A13584F663393F382C6D8D5C0023BC80
                                                                                                                                                                                                                          SHA1:D324D5FBD7A5DBA27AA9B0BDB5C2AEBFF17B55B1
                                                                                                                                                                                                                          SHA-256:13C34A25D10C42C6A12D214B2D027E5DC4AE7253B83F21FD70A091FEDAC1E049
                                                                                                                                                                                                                          SHA-512:14E4A6F2959BD68F441AA02A4E374740B1657AB1308783A34D588717F637611724BC90A73C80FC6B47BC48DAFB15CF2399DC7020515848F51072F29E4A8B4451
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 4%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.2072665819239585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:iF/1nb2eqCQtkhlgJ2ycxFzShJD9CAac2QDeJKcqgQx2XY:Y2PKr+2j8JDefJagQx2XY
                                                                                                                                                                                                                          MD5:104B480CB83BFF78101CF6940588D570
                                                                                                                                                                                                                          SHA1:6FC56B9CF380B508B01CAB342FCC939494D1F595
                                                                                                                                                                                                                          SHA-256:BA4F23BBDD1167B5724C04DB116A1305C687001FAC43304CD5119C44C3BA6588
                                                                                                                                                                                                                          SHA-512:60617865C67115AD070BD6462B346B89B69F834CAF2BFE0EF315FB4296B833E095CD03F3F4D6D9499245C5DA8785F2FBE1AC7427049BD48428EBF74529229040
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                          • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...~y.e.........." ...#..... ......P.....................................................`..........................................9......|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.177411248432731
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:mF/1nb2eqCQt7fSxp/CJPvADQZntxSOvbcqgEvcM+:c2PNKxZWPIDexVlgEvL
                                                                                                                                                                                                                          MD5:06D3E941860BB0ABEDF1BAF1385D9445
                                                                                                                                                                                                                          SHA1:E8C16C3E8956BA99A2D0DE860DCFC5021F1D7DE5
                                                                                                                                                                                                                          SHA-256:1C340D2625DAD4F07B88BB04A81D5002AABF429561C92399B0EB8F6A72432325
                                                                                                                                                                                                                          SHA-512:6F62ACFF39B77C1EC9F161A9BFA94F8E3B932D56E63DAEE0093C041543993B13422E12E29C8231D88BC85C0573AD9077C56AA7F7A307E27F269DA17FBA8EE5A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d....y.e.........." ...#..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14336
                                                                                                                                                                                                                          Entropy (8bit):5.137579183601755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:5siHfq5po0ZUp8XnUp8XjEQnlDtW26rcqgcx2:nqDZUp8XUp8AclDN69gcx2
                                                                                                                                                                                                                          MD5:F938A89AEC5F535AF25BD92221BBC141
                                                                                                                                                                                                                          SHA1:384E1E92EBF1A6BBE068AB1493A26B50EFE43A7E
                                                                                                                                                                                                                          SHA-256:774A39E65CC2D122F8D4EB314CED60848AFFF964FB5AD2627E32CB10EF28A6D0
                                                                                                                                                                                                                          SHA-512:ED0506B9EBCEC26868F484464F9CC38E28F8056D6E55C536ECD2FD98F58F29F2D1CE96C5E574876A9AA6FD22D3756A49BC3EB464A7845CB3F28A1F3D1C98B4D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.158343521612926
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jsiHfq5pwUivkwXap8T0NchH73s47iDJxj2wcqgfvE:9qbi8wap8T0Ncp7n7iDbFgfvE
                                                                                                                                                                                                                          MD5:173EED515A1ADDD1DA0179DD2621F137
                                                                                                                                                                                                                          SHA1:D02F5E6EDA9FF08ABB4E88C8202BAD7DB926258F
                                                                                                                                                                                                                          SHA-256:9D9574A71EB0DE0D14570B5EDA06C15C17CC2E989A20D1E8A4821CB813290D5F
                                                                                                                                                                                                                          SHA-512:8926FBB78A00FD4DC67670670035D9E601AF27CDBE003DC45AD809E8DA1042DDECB997F44ED104BEC13391C8048051B0AAD0C10FDEEDFB7F858BA177E92FDC54
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...qy.e.........." ...#............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text............................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15360
                                                                                                                                                                                                                          Entropy (8bit):5.469810464531962
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RZ9WfqP7M93g8UdsoS1hhiBvzcuiDSjeoGmDZNbRBP0rcqgjPrvE:sA0gHdzS1MwuiDSyoGmD/r89gjPrvE
                                                                                                                                                                                                                          MD5:39B06A1707FF5FDC5B3170EB744D596D
                                                                                                                                                                                                                          SHA1:37307B2826607EA8D5029293990EB1476AD6CC42
                                                                                                                                                                                                                          SHA-256:2E8BB88D768890B6B68D5B6BB86820766ADA22B82F99F31C659F4C11DEF211A1
                                                                                                                                                                                                                          SHA-512:98C3C45EB8089800EDF99ACEA0810820099BFD6D2C805B80E35D9239626CB67C7599F1D93D2A14D2F3847D435EAA065BF56DF726606BB5E8A96E527E1420633D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...ry.e.........." ...#. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):13824
                                                                                                                                                                                                                          Entropy (8bit):5.137646874307781
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:QF/1nb2eqCQtZl9k9VEmosHcBZTHGF31trDbu8oiZmtwcqgk+9TI:q2PXlG9VDos8BZA33rDbuNgk0gk+9U
                                                                                                                                                                                                                          MD5:1DFC771325DD625DE5A72E0949D90E5F
                                                                                                                                                                                                                          SHA1:8E1F39AAFD403EDA1E5CD39D5496B9FAA3387B52
                                                                                                                                                                                                                          SHA-256:13F9ADBBD60D7D80ACEE80D8FFB461D7665C5744F8FF917D06893AA6A4E25E3A
                                                                                                                                                                                                                          SHA-512:B678FB4AD6DF5F8465A80BFB9A2B0433CF6CFAD4C6A69EEBF951F3C4018FD09CB7F38B752BE5AB55C4BE6C88722F70521D22CBCBBB47F8C46DDB0B1ACBFD7D7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\Y..2...2...2......2.i.3...2...3...2...3...2.i.7...2.i.6...2.i.1...2...:...2...2...2.......2...0...2.Rich..2.........PE..d...}y.e.........." ...#..... ......P.....................................................`..........................................9.......:..d....`.......P...............p..,....4..............................P3..@............0...............................text...X........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):17920
                                                                                                                                                                                                                          Entropy (8bit):5.687377356938656
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:bPHdP3MjeQTh+QAZUUw8lMF6D+1tgj+kf4:xPcKQT3iw8lfDUej+
                                                                                                                                                                                                                          MD5:9D15862569E033C5AA702F9E4041C928
                                                                                                                                                                                                                          SHA1:11376E8CB76AD2D9A7D48D11F4A74FB12B78BCF6
                                                                                                                                                                                                                          SHA-256:8970DF77D2F73350360DBE68F937E0523689FF3D7C0BE95EB7CA5820701F1493
                                                                                                                                                                                                                          SHA-512:322F0F4947C9D5D2800DEEBFD198EABE730D44209C1B61BB9FD0F7F9ED5F719AE49F8397F7920BDB368BB386A598E9B215502DC46FBE72F9340876CF40AFFC8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...sy.e.........." ...#.*..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21504
                                                                                                                                                                                                                          Entropy (8bit):5.9200472722347675
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:pljwGpJpvrp/LTaqvYHp5RYcARQOj4MSTjqgPmJDcOwwgjxo:Ljw4JbZYtswvqDc51j
                                                                                                                                                                                                                          MD5:7398EFD589FBE4FEFADE15B52632CD5C
                                                                                                                                                                                                                          SHA1:5EA575056718D3EC9F57D3CFF4DF87D77D410A4B
                                                                                                                                                                                                                          SHA-256:F1970DB1DA66EFB4CD8E065C40C888EED795685FF4E5A6FA58CA56A840FE5B80
                                                                                                                                                                                                                          SHA-512:C26F6FF693782C84460535EBCD35F23AA3C95FB8C0C8A608FB9A849B0EFD735EF45125397549C61248AE06BD068554D2DE05F9A3BA64F363438EDB92DA59481B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...wy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21504
                                                                                                                                                                                                                          Entropy (8bit):5.922439979230845
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:jljwGpJpvrp/LtaqvYHp5RYcARQOj4MSTjqgPmJDcbegjxo:hjw4JVZYtswvqDcb7j
                                                                                                                                                                                                                          MD5:352F56E35D58ABE96D6F5DBBD40D1FEA
                                                                                                                                                                                                                          SHA1:5F0C9596B84B8A54D855441C6253303D0C81AA1B
                                                                                                                                                                                                                          SHA-256:44EED167431151E53A8F119466036F1D60773DDEB8350AF972C82B3789D5D397
                                                                                                                                                                                                                          SHA-512:CB4862B62ABB780656F1A06DADD3F80AEA453E226C38EFAE4318812928A7B0B6A3A8A86FCC43F65354B84FC07C7235FF384B75C2244553052E00DC85699D422A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...uy.e.........." ...#.6... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..,............R..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26624
                                                                                                                                                                                                                          Entropy (8bit):5.879121462749493
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:pDLZ9BjjBui0gel9soFdkO66MlPGXmXcnRDbRj:VBfu/FZ6nPxMRDtj
                                                                                                                                                                                                                          MD5:3C47F387A68629C11C871514962342C1
                                                                                                                                                                                                                          SHA1:EA3E508A8FB2D3816C80CD54CDD9C8254809DB00
                                                                                                                                                                                                                          SHA-256:EA8A361B060EB648C987ECAF453AE25034DBEA3D760DC0805B705AC9AA1C7DD9
                                                                                                                                                                                                                          SHA-512:5C824E4C0E2AB13923DC8330D920DCD890A9B33331D97996BC1C3B73973DF7324FFFB6E940FA5AA92D6B23A0E6971532F3DB4BF899A9DF33CC0DD6CB1AC959DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...zy.e.........." ...#.H..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...HG.......H.................. ..`.rdata..X....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26624
                                                                                                                                                                                                                          Entropy (8bit):5.937696428849242
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:VYL59Ugjaui0gel9soFdkO66MlPGXmXcXVDuSFAj:60xu/FZ6nPxMlD7Kj
                                                                                                                                                                                                                          MD5:2F44F1B760EE24C89C13D9E8A06EA124
                                                                                                                                                                                                                          SHA1:CF8E16D8324A7823B11474211BD7B95ADB321448
                                                                                                                                                                                                                          SHA-256:7C7B6F59DD250BD0F8CBC5AF5BB2DB9F9E1A2A56BE6442464576CD578F0B2AE0
                                                                                                                                                                                                                          SHA-512:2AACB2BB6A9EBA89549BF864DDA56A71F3B3FFEDB8F2B7EF3FC552AB3D42BC4B832F5FA0BA87C59F0F899EA9716872198680275A70F3C973D44CA7711DB44A14
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<Y..R...R...R......R.i.S...R...S...R...S...R.i.W...R.i.V...R.i.Q...R...Z...R...R...R.......R...P...R.Rich..R.................PE..d...|y.e.........." ...#.H..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....G.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..,............f..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12800
                                                                                                                                                                                                                          Entropy (8bit):5.027823764756571
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:/RF/1nb2eqCQtkbsAT2fixSrdYDt8ymjcqgQvEW:/d2P6bsK4H+DVwgQvEW
                                                                                                                                                                                                                          MD5:64604EE3AEBEE62168F837A41BA61DB1
                                                                                                                                                                                                                          SHA1:4D3FF7AC183BC28B89117240ED1F6D7A7D10AEF1
                                                                                                                                                                                                                          SHA-256:20C3CC2F50B51397ACDCD461EE24F0326982F2DC0E0A1A71F0FBB2CF973BBEB2
                                                                                                                                                                                                                          SHA-512:D03EEFF438AFB57E8B921CE080772DF485644DED1074F3D0AC12D3EBB1D6916BD6282E0E971408E89127FF1DAD1D0CB1D214D7B549D686193068DEA137A250CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........."...L...L...L......L.q.M...L..M...L...M...L.q.I...L.q.H...L.q.O...L...D...L...L...L.......L...N...L.Rich..L.........PE..d....y.e.........." ...#............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7444
                                                                                                                                                                                                                          Entropy (8bit):4.580794980254807
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:G8oS34B7n303D37Bn3Jso37cfp3Mg3H373R58noct36R9RFu:GQU7ETrxZvqTXLSoct36Pzu
                                                                                                                                                                                                                          MD5:66722ED97BCBFD3DAE3C8264413859AB
                                                                                                                                                                                                                          SHA1:400A93B213FCF9BBC9785881EA82ADB9F444CD6C
                                                                                                                                                                                                                          SHA-256:ECD4283A660F2CF72849B323810D7EADD063120B6F561E05AA1243A5B280946A
                                                                                                                                                                                                                          SHA-512:B898BAC9652D7532384ED5CC53FA62DB55D516421D13F815A3E6D5E80AD4C69555F1A7E6C51F8B0A234614824EEE01D6731458F90D40A585990F84A58B9ABE44
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......caB............%.......0T......K:^.....Uj......`.....P..YJ...V.E.4...*...........>...7........B<s.....B\>...6........+.s.....zq.......9.......vR......@.......@.......:....;.8Z....!.g.N......F................t.....D ....z.k.N.......I......^......`#.......2.......G........N...7......N......{..................K...............GN......NO...5.........K.H...@.........pN......V............q..................>...N.........~.....5..%c...:.z.q....i...4....".A.f.e.g.e.i.x. .u.n. .f.i.l.t.r.e..........Add Filter.....FilterNameDialogClass.......N.o.m. .d.e.l. .f.i.l.t.r.e.:..........Filter Name:.....FilterNameDialogClass.......S.e.n.s.e. .t...t.o.l..........Untitled.....QHelp.....`.N.o. .s.'.h.a. .p.o.g.u.t. .c.o.p.i.a.r. .e.l. .f.i.t.x.e.r. .d.e. .c.o.l...l.e.c.c.i...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....H.N.o. .s.'.h.a. .p.o.g.u.t. .c.r.e.a.r. .e.l. .d.i.r.e.c.t.o.r.i.:. .%.1..........Cannot create directory: %1.....QHelpCollect
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15297
                                                                                                                                                                                                                          Entropy (8bit):4.708378368926237
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:hmv1gdEYEiNrVhTBvAn1ca1f5lwHoJr0vwuxqsP/5jxA:o1gdEvgbloCof9ixqspW
                                                                                                                                                                                                                          MD5:ED228F0F60AE9AEC28AB9171D5AE9590
                                                                                                                                                                                                                          SHA1:7F061CF0C699D125A5531E3480C21964452F45EA
                                                                                                                                                                                                                          SHA-256:4AC56FC63E400943BAB13F1D4C418502138908E1D488C24AEE6131D3D17552AA
                                                                                                                                                                                                                          SHA-512:794CC671C08BFC50980820A6389B9D0D3514619AD0A8F18EFD5554CBBF2482192DF00B9D3B05FEE45F42276E63E2375FB28E193930D426245035B4B0E3E14ED8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......cs_CZB...H.(.......(.......0T......0T......5w...0..Uj......`.......a[......a[....$.......p..........t.......t...........!..1"....T.39....T.39.......s...0......(......7/.................B<s...L..MQ......M^../q..........J..6@.0....*B.O5Q..'..O5^..(A..)Q...X..)^......o>..........+....J..6.......4....t.....8dz..5..D ....R.D ......k.A.....k.A.....k.N.....k.N.......n.."....I..........................2...21......2>..........d.............T..G...4...w...!N......&O......&....!..".......#E..,...,.......)....Q..$/...^..$................$a......6.>.. t......5...K.......K....)......5E.W.b..-.._Xa..%a._Xn..%...GA......GN...?......,9..~.......TH..3..!....*..K.H..4h.........pA...J..pN..........7..P.~.. ..o.....0..(....*..(..........3V..~....T.s.1.....s.>..._.o....0..o....1p.z.q..........'9.....#........^.........h....2................Z..e... .i..8J......(.D.o.v.o.d.e.m. .p.r.o. .t.o. .b.y. .m.o.h.l.o. .b...t.,. .~.e. .d.o.k.u.m.e.n.t.a.c.e. .j.e. .s.t...l.e. .j.e.a.t...
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4795
                                                                                                                                                                                                                          Entropy (8bit):4.530246422531362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:X82wNlnKfN1LMFy7LsF3ZqBFZjWo0koBLqBXXjGL0qU7UqB7zoElmP5MUu4DZIHU:XM01f7eOnoB8X2s7Vfg5Mi4beXiOUu
                                                                                                                                                                                                                          MD5:1D09BEE1FB55A173F7EB39B9A662A170
                                                                                                                                                                                                                          SHA1:C77F0A148262A91679F19689E4790B754D45D5D5
                                                                                                                                                                                                                          SHA-256:6BB092552A398687119F6D52145F04BF8373977446D8F00C0DCBD56B96829F0F
                                                                                                                                                                                                                          SHA-512:BE5A31A6135E8DB024A8B0EB20C4D8EECBF76861F83FF83B4CA97327DB74AD94BB5D77B4E0A59A33B697C32A4EACD61B8C878951F2C545385C74D99FCE56FEE1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......daB.....%.....m.0T......Uj....V.`....................k.B<s.....B\>..........6.+.s...............t.....D ....|.k.N...9...I...O..2.......G....B...N...O..............!..K...._..........GN...........@.K.H.............pN..............>.....~.....m..%c.....z.q....i..........U.n.a.v.n.g.i.v.e.t..........Untitled.....QHelp.....D.K.a.n. .i.k.k.e. .k.o.p.i.e.r.e. .s.a.m.l.i.n.g.s.f.i.l.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....6.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .m.a.p.p.e.n.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....V.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .i.n.d.e.k.s.t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1...........&Cannot create index tables in file %1......QHelpCollectionHandler.....J.K.a.n. .i.k.k.e. .o.p.r.e.t.t.e. .t.a.b.e.l.l.e.r. .i. .f.i.l.e.n. .%.1........... Cannot create tables in file %1......QHelpCollectionHandler.....P.K.a.n. .i.k.k.e. .i.n.d.l...s.e. .s.q.l.i.t.e.-.d.a.t.a.b.a.s.e.-.d.r
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7570
                                                                                                                                                                                                                          Entropy (8bit):4.550982634910665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:8y/gPmmhL/7LlSivP6kBL7jb0RNUzzpld4UGG3Ik18fLP0L7fGc0OeVP8a8hiAwj:1OD7hx/Bv3oNuFX4iqgv34fZsu
                                                                                                                                                                                                                          MD5:3B070D169E3381E2FB081172934AAD00
                                                                                                                                                                                                                          SHA1:70886EB7EF566B296D0814BD4C2440AC176699D6
                                                                                                                                                                                                                          SHA-256:9962523FBAE9F1E4C3B5C3C16860D059291CB30DC5EBE5A5EDA4C836A03FED1E
                                                                                                                                                                                                                          SHA-512:271B730B5A7358E923BBBC6FA074A72DA52FA47E3B7726779EF7034200EDA09BF0E1AE4E7B11B59F76805F48DC285F6EFC245EB9C7F4A748BE82B25CEE1DDCAE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......deB..........B.%.....5.0T......K:^.....Uj....?.`.....f..YJ...V.E.4...............>............B<s...z.B\>...\........+.s...Q.zq....C..9....4..vR...B..@.......@.......:......8Z......g.N......F....>...........t.....D ......k.N.......I......^....|.`#....I..2....<..G....^...N.........................;..........K....y..........GN......NO...........,.K.H.............pN......V...................."..........>.............~........%c.....z.q....i........".F.i.l.t.e.r. .h.i.n.z.u.f...g.e.n..........Add Filter.....FilterNameDialogClass.....".N.a.m.e. .d.e.s. .F.i.l.t.e.r.s.:..........Filter Name:.....FilterNameDialogClass.......O.h.n.e. .T.i.t.e.l..........Untitled.....QHelp.....\.D.i.e. .K.a.t.a.l.o.g.d.a.t.e.i. .k.a.n.n. .n.i.c.h.t. .k.o.p.i.e.r.t. .w.e.r.d.e.n.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....\.D.a.s. .V.e.r.z.e.i.c.h.n.i.s. .k.a.n.n. .n.i.c.h.t. .a.n.g.e.l.e.g.t. .w.e.r.d.e.n.:. .%.1..........Cannot create directory: %
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16
                                                                                                                                                                                                                          Entropy (8bit):4.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4n:CwZ
                                                                                                                                                                                                                          MD5:BCEBCF42735C6849BDECBB77451021DD
                                                                                                                                                                                                                          SHA1:4884FD9AF6890647B7AF1AEFA57F38CCA49AD899
                                                                                                                                                                                                                          SHA-256:9959B510B15D18937848AD13007E30459D2E993C67E564BADBFC18F935695C85
                                                                                                                                                                                                                          SHA-512:F951B511FFB1A6B94B1BCAE9DF26B41B2FF829560583D7C83E70279D1B5304BDE299B3679D863CAD6BB79D0BEDA524FC195B7F054ECF11D2090037526B451B78
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`...
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10704
                                                                                                                                                                                                                          Entropy (8bit):4.481291573289571
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:q9J9j7e4BQhD0h61nnKz+DJF/45ojDU9V1Wa/rmtIBMH:Wp64ShDnnKz+FhjQpWa/ytoMH
                                                                                                                                                                                                                          MD5:9EDF433AB9EE5FC7CF7782370150B26A
                                                                                                                                                                                                                          SHA1:A918AE15A0DF187C7789BE8599A80E279F039964
                                                                                                                                                                                                                          SHA-256:FD16B279F8CF69077F75E94D90C9C07A2AFFF3948A579E3789F5FFB5E5F4202D
                                                                                                                                                                                                                          SHA-512:88245F6FBAAF603A03D7EA2341411AE040791D47C9FF110C6D6CDD8165F0A8BA7A4A0DA5CD543BBE95A4E93FE3A81E95B3664E00C11791FBCB4923E3A80ABC60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......es_ESB...(.(.....7.0T..../.5w... C.Uj......`.......a[....0..........t..............39..........&e.........B<s...D..M^..............J..%p.O5^...I..)^...1..o>.......J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>....................G...#...w............!.......%..,................^............$a......6.>..........#...K...........$C.W.b....._Xn......GN...|..~.......TH.."..!.....5.K.H..#f.........pN...j......'..P.~... .o........(....>....."<..~....c.s.>.....o.... ..z.q..........................u.h....!p.......*..e....Qi..'}......(.L.a. .r.a.z...n. .d.e. .e.s.t.o. .p.u.e.d.e. .s.e.r. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n. .e.s.t... .s.i.e.n.d.o. .i.n.d.e.x.a.d.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....2.R.e.s.u.l.t.a.d.o.s. .d.e. .l.a. .B...s.q.u.e.d.a..........Search Results.....QCLu
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10922
                                                                                                                                                                                                                          Entropy (8bit):4.459946393010639
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:w4BIn67/WsmoB3r6M/eYlSbyE7DnvE7pcn9nPJZe7nOFovzcNn7Uhmio+2/p53I/:w4N19fq3n2c9Bucuhmi52/X3Qpam
                                                                                                                                                                                                                          MD5:D520C7F85CC06C66715A2B6622BF0687
                                                                                                                                                                                                                          SHA1:47292D068172FBC9DC0D9BE2F479E890A37CE138
                                                                                                                                                                                                                          SHA-256:687E351C062F688AAFF6CF05218D6017B80B1A1B4238D1D30250A55EE41C5FED
                                                                                                                                                                                                                          SHA-512:736B50BB64751B127300BCAFE88888A9D9A2081CBF934EDCFFEF6CEF0575505AFDF714273A97671ABB598AE3D23C8E55F7DCD632FB0AA219ED5F763768576E04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......fr_FRB...(.(.....y.0T....K.5w...!1.Uj....*.`.......a[............5..t..............39....m.....'W.......S.B<s...d..M^.. ...........J..&`.O5^...+..)^......o>.......J..&.......$....t.....8dz..%..D ......k.N.....k.N...D...n.......I...........c..2>..........M.........G...$...w....K..................,................^............$a......6.>...c......$...K....'......%M.W.b....._Xn...j..GN......~.......TH..#..!.......K.H..$Z......,..pN..........'..P.~.....o........(....h.....#4..~......s.>...M.o....!..z.q...........p......L.........h...."^.......b..e.....i..(W......(.I.l. .e.s.t. .p.o.s.s.i.b.l.e. .q.u.e. .c.e.l.a. .s.o.i.t. .d... .a.u. .f.a.i.t. .q.u.e. .l.a. .d.o.c.u.m.e.n.t.a.t.i.o.n. .e.s.t. .e.n. .c.o.u.r.s. .d.'.i.n.d.e.x.a.t.i.o.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.e. .:..........Note:.....QCLuceneResultWidget.....2.R...s.u.l.t.a.t.s. .d.e. .l.a. .r.e.c.h.e.r.c.h.e.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10891
                                                                                                                                                                                                                          Entropy (8bit):4.5087667371046205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Im7gBZHx4hCTNarW6EJDvoIR765f40wqNcMi/8F/Ihon:v0fHccarW6Eh61wqNcMi/Q/won
                                                                                                                                                                                                                          MD5:B62C74793741FC386332A59113E8D412
                                                                                                                                                                                                                          SHA1:589CE099F2C1D92581B5CF0E17BE49A2BF0014D4
                                                                                                                                                                                                                          SHA-256:7399A248609974773F60866C87B78EA7DFBC4F750313D692F7886CD763883C9F
                                                                                                                                                                                                                          SHA-512:D8E1A3B3732662BA572A1387651F2625742710834BEDB41809DA47B5D23020AA1B558B64A00C10C605D1844F0544483163F4A6227CAFFA5ECDABF3BBF4E12D9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......gl_ESB...8.(.......0T......Uj......`.....`.a[....F..........t..............1"... S.39.......s...!.............'F.........B<s...8..MQ.. ...........J..&S.0.....x.O5Q......)Q...O..o>...{.......#...J..&.......$....t.....8dz..%..D ......k.A.....k.A.......n.......I.................."...21....................G...#...w............[...!...?...........Q...?........$a....v.6.>..........$...K...........%0._Xa......GA...n..........~.......TH..#..K.H..$M.........pA...Z......'..P.~...B.o........(..........#+..~......s.1.....o....!..z.q...e.............................. ..e....wi..((......(.A. .r.a.z...n. .d.i.s.t.o. .p.o.d.e. .s.e.r. .q.u.e. .a. .d.o.c.u.m.e.n.t.a.c.i...n. .a...n.d.a. .e.s.t.e.a. .a. .i.n.d.e.x.a.r.s.e...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.....*.R.e.s.u.l.t.a.d.o.s. .d.a. .p.r.o.c.u.r.a..........Search Results.....QCLucene
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10284
                                                                                                                                                                                                                          Entropy (8bit):4.674501432335502
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:RNY+rCG3e7LBqYqYseBb/FEWBgSn62TdJgDO9esYGY3DtgGh621XlZ/8kWvIMK:4+rheHYYZdBb/pgSn62T/FeVD3DGGh62
                                                                                                                                                                                                                          MD5:5A56E9E2ED6ECE3F249D1C2A7EB3B172
                                                                                                                                                                                                                          SHA1:D6F079F40FBB813B0293C1D2210BAE7084092FEC
                                                                                                                                                                                                                          SHA-256:70F33B569C2942F41C6D634EA6A61CB8D80EB2C7011BAD48EF6DBAE9677960D5
                                                                                                                                                                                                                          SHA-512:28947128FC51791CFDBFD3958FAF9B33979DB52C90AE0159EDB01FE6032284EB37BC05187162983A0435560BCEA864B008F499CDB4CE662792599FE20A37972A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......hu_HUB...(.(.......0T......5w......Uj......`.....4.a[....N..........t....".........39..........%..........B<s...8..M^...8..........J..$..O5^......)^...]..o>.......J..$......."N...t.....8dz..#g.D ......k.N...>.k.N.......n.......I..............2>..........a.........G...!...w.......................,................^............$a......6.>.........."...K....m......"..W.b...l._Xn...~..GN......~.......TH..!F.!.......K.H..!..........pN..........%..P.~...<.o........(.......... ...~......s.>...{.o.....c.z.q...K.......v......l.........h.... ........t..e....mi..%.....~.(.E.z. .a.m.i.a.t.t. .l.e.h.e.t.,. .h.o.g.y. .a. .d.o.k.u.m.e.n.t...c.i... .m...g. .i.n.d.e.x.e.l...s. .a.l.a.t.t. .v.a.n...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......M.e.g.j.e.g.y.z...s.:..........Note:.....QCLuceneResultWidget.....&.K.e.r.e.s...s.i. .e.r.e.d.m...n.y.e.k..........Search Results.....QCLuceneResultWidget.......A
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10612
                                                                                                                                                                                                                          Entropy (8bit):4.458970627057882
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:nRxcfy71b+myBN16cbc+w45rtlTnzo7uHp3JQJ9cVu4BJ1G82g33vOVrNL/7nEF1:RR4R/fJn9JizTgnqrNL/b0hH2K
                                                                                                                                                                                                                          MD5:3639B57B463987F6DB07629253ACD8BF
                                                                                                                                                                                                                          SHA1:65935A67C73F19FCF6023FB95030A5ACAF9DA21C
                                                                                                                                                                                                                          SHA-256:316FE8D0815E2B4B396895BEB38EF1A40431915B5E054DF80F4C0CD556F26E4B
                                                                                                                                                                                                                          SHA-512:AD7CA93D93A69F273CE80BE7F2F477543B9C5F9C7E4D7448223BFF084EA956B626D6837F22D83C5E282688B938F58C29073C4B5C6F26A797F716C14FABF9FFEE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......it_ITB...(.(.....g.0T....y.5w... ..Uj....2.`.......a[............'..t..............39..........&..........B<s...j..M^...h......K...J..%..O5^...K..)^......o>...u...J..%.......#....t.....8dz..$..D ......k.N.....k.N.......n.......I..............2>.................o..G..."...w............-......./..,................^...'........$a......6.>..........#...K...........$..W.b....._Xn......GN......~.......TH.."n.!.....5.K.H..#"......>..pN..........&..P.~.....o.....~..(....p.....!...~....A.s.>.....o.... ..z.q..........................q.h....!0.......*..e....;i..'!......(.L.a. .c.a.u.s.a. .d.i. .c.i... .p.o.t.r.e.b.b.e. .e.s.s.e.r.e. .c.h.e. .l.'.i.n.d.i.c.i.z.z.a.z.i.o.n.e. .d.e.l.l.a. .d.o.c.u.m.e.n.t.a.z.i.o.n.e. ... .a.n.c.o.r.a. .i.n. .c.o.r.s.o...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......N.o.t.a.:..........Note:.....QCLuceneResultWidget.......R.i.s.u.l.t.a.t.i. .d.e.l.l.a. .r.i.c.e.r.c.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7917
                                                                                                                                                                                                                          Entropy (8bit):5.680408580146589
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:mP6J37GcBzRjYEPEJJGTnwfJJxb7FTPjzzZBL3/q/I53:mSVqclR5s6Tnwfb7Pj/PL3/q/w3
                                                                                                                                                                                                                          MD5:1380A9352C476071BDA5A5D4FED0B6C5
                                                                                                                                                                                                                          SHA1:9B737ED05F80FE5D3CD8F588CCEC16BB11DD3560
                                                                                                                                                                                                                          SHA-256:AE603B2C0D434D40CDE433FFCBA65F9EE27978A9E19316007BE7FE782A5B8B47
                                                                                                                                                                                                                          SHA-512:EC3D68126488C3A163898BACAF7E783217868573635182CAF511ED046B4BE1F99A71FBB24DA607CCB50EDAF70893007AAEE9A6BAAE4C1CD33465A0915AA965DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......jaB...(.(.....S.0T......5w....'.Uj......`.......a[............u..t............!.39.....................B<s......M^..............J...>.O5^...O..)^......o>.......J...............t...w.8dz.....D ......k.N.....k.N...H...n.......I...........i..2>...<......G......9..G....P..w............i..........,................^..........'.$a......6.>...5..........K............S.W.b...2._Xn......GN...@..~.......TH.....!.......K.H.............pN...........S.P.~.....o.....|..(..............~....o.s.>.....o.......z.q..................@.........h.....&....... ..e.....i........@.(0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0K0.0W0.0~0[0.0..).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..:..........Note:.....QCLuceneResultWidget......i.}"}Pg...........Search Results.....QCLuceneResultWidget.....R0.0.0.0.0.0.0n}"_.0nO\b.0L}BN.0W0f0D0j0D0_0.0.i.}"}Pg.0LN.[.Qh0jS..`'0L0B0.0~0Y0..........VThe search results may
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5708
                                                                                                                                                                                                                          Entropy (8bit):5.698914195742074
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:elPQHJ6L4c7LaQaFQv2QEhBL+Ejma0W40U0BzlQlcrnUSaTIdspIc18CLRSM3LBY:dHI97W1BbNz1VqqzJpoj5y5uY7OGrWFE
                                                                                                                                                                                                                          MD5:CD15674A652C2BF435F7578E119182F8
                                                                                                                                                                                                                          SHA1:AEA22E4A0D21396733802C7AB738DDD03737B7D6
                                                                                                                                                                                                                          SHA-256:F11C64694E8E34E1D2C46C1A1D15D6BA9F2DB7B61DE4FDF54ECA5AB977C3E052
                                                                                                                                                                                                                          SHA-512:88BFA112F4DBC0BFB4013CE0937E5180B4AB4A217FC8A963798C7C86532E794E4A1AD88416AE42F26A1C0631B465A5D69BFE75366E048502F5E21F4115A12F19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......koB............%.......0T......K:^...g.Uj......`........YJ...>.E.4...........z...>..........;.B<s...K.B\>...b........+.s.....zq....[..9....F..vR......@.......@.......:....c.8Z......g.N...7..F....|...........t.....D ......k.N.......I...m..^......`#....!..2.......G....@...N.................................X..K....{.......i..GN......NO.............K.H..........S..pN...z..V...............................>...........:.~.....i..%c.....z.q....i...s......D.0. .............Add Filter.....FilterNameDialogClass.......D.0. .t...:..........Filter Name:.....FilterNameDialogClass........... ...L..........Untitled.....QHelp.....(...L... ...|.D. .....`. ... ...L.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....".....0...|. .... ... ...L.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....2...|. .%.1... ...x. .L.t...D. .... ... .................&Cannot create index tables in file %1......QHelpCollectionHandler.....,.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9673
                                                                                                                                                                                                                          Entropy (8bit):4.622652249027856
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:TO/7kBL9wGu3wtCnlhLJUBB7oph+mZ18LgP:T8QnwcCnlhdvphpZ18LgP
                                                                                                                                                                                                                          MD5:2B68446B69D9AA40B273D75A581D2992
                                                                                                                                                                                                                          SHA1:8A09BD38998543B74E2673478EDD54FB4BBDD068
                                                                                                                                                                                                                          SHA-256:CC6CB4D8C54086224672F2E49E623C8CB7C0C1CD65B8D5ECD42FC9BA3A6065BD
                                                                                                                                                                                                                          SHA-512:F3A3D6A416B3411613B06FC3EE56625D4D4DE80087182AB0D0601E49314861ABEF97D11A15B4C0511911544A59FBC4A4A52F0CCF0FD43F763A76A8922D8E57B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......plB.....(.......0T....T.5w......Uj... R.`.......a[...............t............2.39....H......6.......n.B<s.. ...M^..._......6.O5^...F..)^......o>...............t.....D ......k.N.....k.N.../...n.......I...W..........2>...w................G.......w............&.......:..,................^...(..... ..$a....?.6.>...$..........K......W.b....._Xn......GN...Y..~......!.....*.K.H...E....."...pN...-.........P.~...}.o........(....1..~......s.>......%c.."..o.....r.z.q............................h................e.....i..#.......N.i.e.n.a.z.w.a.n.y..........Untitled.....QHelp.....P.N.i.e. .m.o.|.n.a. .s.k.o.p.i.o.w.a... .p.l.i.k.u. .z. .k.o.l.e.k.c.j...:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....>.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .k.a.t.a.l.o.g.u.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....H.N.i.e. .m.o.|.n.a. .u.t.w.o.r.z.y... .t.a.b.e.l. .w. .p.l.i.k.u. .%.1........... Cannot create tables in file
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7288
                                                                                                                                                                                                                          Entropy (8bit):5.297177914619657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:dBJjvfq7D6X68uBAzlp5W9+yBPZZZMM7vL0PXJL:JKrMEL0PXJL
                                                                                                                                                                                                                          MD5:794AF445A5D7082D51BD22683449F86D
                                                                                                                                                                                                                          SHA1:3A0C369872B112A1572AA17EEB814B168B225D98
                                                                                                                                                                                                                          SHA-256:557B644E6DA5F1EC720EF93965617087E4D1F40B2494CC5AA524CF3796108DE7
                                                                                                                                                                                                                          SHA-512:D42C870A16AEE7626BBE24886AD423895529A2F1A51AC2DBC303BC0E4EF9D3241FE894ECA3F7217AD408C8DCEE165CA4B89D84570357B0EB80340A3F72B0A846
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......ruB..........\.%.......0T......K:^.....Uj....L.`........YJ...X.E.4...............>............B<s.....B\>............+.s.....zq.......9....B..vR...L..@.......@....G..:......8Z......g.N......F....>...........t.....D ....R.k.N...E...I...W..^......`#....s..2.......G....^...N.........................K.......d..K............O..GN...b..NO.............K.H.............pN...P..V....................g..........>.............~........%c.....z.q....i........$...>.1.0.2.;.5.=.8.5. .D.8.;.L.B.@.0..........Add Filter.....FilterNameDialogClass.........<.O. .D.8.;.L.B.@.0.:..........Filter Name:.....FilterNameDialogClass.........5.7.K.<.O.=.=.K.9..........Untitled.....QHelp.....b...5. .C.4.0.;.>.A.L. .A.:.>.?.8.@.>.2.0.B.L. .D.0.9.;. .:.>.;.;.5.:.F.8.8. .A.?.@.0.2.:.8.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....<...5. .C.4.0.;.>.A.L. .A.>.7.4.0.B.L. .:.0.B.0.;.>.3.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....`
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10388
                                                                                                                                                                                                                          Entropy (8bit):4.70568613551943
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:uPq7iBWseXKkVu4+Qv9zEJ1xGMaLNmBgJqdC6/MxIMt:LWcseV04Xv9zEoLNDJqdX/MxRt
                                                                                                                                                                                                                          MD5:75C94E59F1FC5312AE25381C247AF992
                                                                                                                                                                                                                          SHA1:E3E5F4582CC5FAFE6DF43644D11484861023C084
                                                                                                                                                                                                                          SHA-256:F41E33E1D790BD0D3EB180F1F875BC191FE74773628F25C2CAD95E1402E66867
                                                                                                                                                                                                                          SHA-512:959B8F4D57FC9728DD4804322333D1792D45A0EE85615B559E0CA3BD2DEA22E2C8C68C6482AE9425D29C819B0ED27473EDDC82EF4B6ECFFB2E2E7B56E1509B63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......sk_SKB...8.(.......0T......Uj......`.....0.a[....8..........t..............1"......39.......s........... .....%..........B<s...6..MQ..............J..$-.0.......O5Q......)Q...;..o>...........G...J..$......."....t.....8dz..#..D ......k.A...2.k.A.......n..._...I.................. ...21..........e.........G...!...w....Y...........!...........=...Q............$a......6.>.........."...K....i......# ._Xa..."..GA..............~.......TH..!{.K.H.."7.........pA..........%..P.~.....o........(..........!...~....u.s.1.....o.......z.q...c..............................f..e....9i..&-......(.D...v.o.d.o.m. .m...~.e. .b.y.e. .t.o.,. .~.e. .d.o.k.u.m.e.n.t...c.i.a. .s.t...l.e. .n.i.e. .j.e. .z.i.n.d.e.x.o.v.a.n.....).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......P.o.z.n...m.k.a.:..........Note:.....QCLuceneResultWidget.....".V...s.l.e.d.k.y. .h.>.a.d.a.n.i.a..........Search Results.....QCLuceneResultWidg
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10363
                                                                                                                                                                                                                          Entropy (8bit):4.613473842638716
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vNBqTi7qBCVIQf54EslZ2Jy/L/BnmpP0bX3caK6q1B6/hgIlCCUb0:vjq2+UVT4ESZOYmpP0bX26q1I/yqCCUw
                                                                                                                                                                                                                          MD5:3B0AEE27B193A8A563C5CB5C7C4FE60F
                                                                                                                                                                                                                          SHA1:C94E832595EC765370553468F87C02DB7E7D138A
                                                                                                                                                                                                                          SHA-256:2EC955E662407EBCD8DCDAE5AAA21E4108E0B5B0AEE0E9DB712C27072943535F
                                                                                                                                                                                                                          SHA-512:EBC25C378126876F44279E23CA0CF06FC9E7D5F51AD7E3DBDABA7A50C81112EDC1C76F7FD0AF47E447A93C3593BB953A0C9C1FBBFC49494E6B29BF21655F690E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......slB...8.(.....E.0T......Uj......`.......a[............!..t..............1"....;.39.......s....^............$........i.B<s...,..MQ..........}...J..#..0.....Z.O5Q...[..)Q......o>...............J..$I......"W...t...C.8dz..#H.D ......k.A.....k.A.......n.......I.................. P..21....................G...!...w............?...!...3...........Q...+........$a....>.6.>.........."...K...........".._Xa......GA..............~....A..TH..!I.K.H..!..........pA...>......%..P.~...>.o........(....d..... ...~......s.1.....o.......z.q.....................................e....{i..&.....z.(.R.a.z.l.o.g. .j.e. .m.o.r.d.a. .t.o.,. .d.a. .s.e. .d.o.k.u.m.e.n.t.a.c.i.j.o. .a.e. .v.e.d.n.o. .i.n.d.e.k.s.i.r.a...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.......O.p.o.m.b.a.:..........Note:.....QCLuceneResultWidget.....".R.e.z.u.l.t.a.t.i. .i.s.k.a.n.j.a..........Search Results.....QCLuceneResultWidget.......R.e.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4629
                                                                                                                                                                                                                          Entropy (8bit):4.68793836539357
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:BoiK0UD2wMLb7Lqlguotqbww5BLNwWjK0kHU9zuQlUVUfniqthweEIFwC18lLEGA:PXFf7pU75BWWOpcJcVqDFNz8brgyf76r
                                                                                                                                                                                                                          MD5:32D6EE3D8EE6408A03E568B972F93BCB
                                                                                                                                                                                                                          SHA1:582EE079DBD42000C378E0701D26405750524DBA
                                                                                                                                                                                                                          SHA-256:EBDECA0CFEE7A9441DEB800BABFD97C63BC4E421DA885C55B3BD49725EBACD25
                                                                                                                                                                                                                          SHA-512:24AAA30B9CB4DB82A57411FBA24A87D70D8B845AE48A6FDA633D0BE6B824B58FDD2F450C2B385F16F49E2F9C6FA0A3124FD0F28594726940F996C66F8F3216CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......tr_TRB.....%.....[.0T......Uj......`.....$..............L.B<s.....B\>..........4.+.s...............t.....D ......k.N...5...I......2.......G....5...N..........a...............f..K....9..........GN...........@.K.H..........q..pN...t..........>...z.~...../..%c.....z.q....i..........B.a._.l.1.k.s.1.z..........Untitled.....QHelp.....J.K.o.l.e.k.s.i.y.o.n. .d.o.s.y.a.s.1. .k.o.p.y.a.l.a.n.a.m.1.y.o.r.:. .%.1..........Cannot copy collection file: %1.....QHelpCollectionHandler.....2.D.i.z.i.n. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r.:. .%.1..........Cannot create directory: %1.....QHelpCollectionHandler.....\.%.1. .d.o.s.y.a.s.1.n.d.a. .d.i.z.i.n. .t.a.b.l.o.l.a.r.1. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r...........&Cannot create index tables in file %1......QHelpCollectionHandler.....N.%.1. .d.o.s.y.a.s.1.n.d.a. .t.a.b.l.o.l.a.r. .o.l.u._.t.u.r.u.l.a.m.1.y.o.r........... Cannot create tables in file %1......QHelpCollectionHandler.....P.S.q.l.i.t.e. .v.e.r.i.t.a.b.a.n.1. .s...r...c...
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9750
                                                                                                                                                                                                                          Entropy (8bit):5.281035122342072
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:eMp79BCN+u8hhbHbny+HJouHgei50JBSfDvbetpP/RIkT:eIhgNgBbny+phiS3SfDDetpP/RRT
                                                                                                                                                                                                                          MD5:90A776917D534B65942063C319573CDC
                                                                                                                                                                                                                          SHA1:5DF3B213D985A3BBDB476B37B7780D7D7DF17E41
                                                                                                                                                                                                                          SHA-256:497CFC473684692EE44D7A3795E8FB2270C57069FD9EB98A615DD29AB9BE8A7C
                                                                                                                                                                                                                          SHA-512:B34A019716B50CE8E1E20AC32756B3B0D5802971F7A04F4BDDE2418DA551AFB9742B79E934979DB6FAB9DAC05D7D26A3B19ABA77158321F8D9AAB08AEBBD455A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......uk_UAB...(.(.....?.0T......5w......Uj......`.......a[...............t............K.39....u....."..........B<s...8..M^...j......y...J..!..O5^...Y..)^......o>...o...J..":...... <...t...E.8dz..!3.D ....".k.N.....k.N...d...n.......I..............2>...>......o.........G.......w............E.......e..,................^...S........$a......6.>...'...... y..K........... ..W.b....._Xn......GN...p..~.......TH...4.!.....9.K.H.............pN..........#].P.~...~.o.....N..(....b.........~......s.>.....o.....o.z.q..........................U.h.............D..e.....i..#.......(...@.8.G.8.=.>.N. .F.L.>.3.>. .<.>.6.5. .1.C.B.8. .B.5.,. .I.>. .4.>.:.C.<.5.=.B.0.F.V.O. .4.>.A.V. .V.=.4.5.:.A.C.T.B.L.A.O...).........M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget.........@.8.<.V.B.:.0.:..........Note:.....QCLuceneResultWidget.....". .5.7.C.;.L.B.0.B.8. .?.>.H.C.:.C..........Search Results.....QCLuceneResultWidget....... .5.7
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6441
                                                                                                                                                                                                                          Entropy (8bit):5.790303416386852
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:pB37nBD4H5PCyLDxLSzJPduYx9vja/FIgH9yIFqfs:rTZ4HUAD1S1JFe/F59PFqfs
                                                                                                                                                                                                                          MD5:9297A6905B8B1823BF7E318D9138A104
                                                                                                                                                                                                                          SHA1:3DB992A1B3BBCAF314B7EA4A000D6334D7492A52
                                                                                                                                                                                                                          SHA-256:C02AAA20923F18ADDAB520BE5CB84EFD4C723396BDC24B4C9A72D406F101C7B4
                                                                                                                                                                                                                          SHA-512:01F12CEE0AE456D78942A6049E1C77F94B406C8FFB4A5944DE15E54D1C760CDBA13279530A8F29B1443D1BBC647D3AF5436AAD8C43EB3944316C48300B3827E4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......zhB......I....L.0T......Uj......`.......a[...............t....P..@....Z.......<.........39.......s....2.................B<s......MQ..........9...J......31.....0.......O5Q......)Q...^..o>...........(...........J...V...........t.....8dz.....D ....Z.k.A.....k.A.......n.......I...........t..w................!...........o.......D...Q...E........$a......6.>...h...............%._Xa......GA..........._..TH...r.........pA.............P.~.....o.....].~.q.............~......o.....h.z.q...........H..0q....................i........2..S.u...y.`.Q.v.S.V.S..f/V.N:..e.hckcW(..}"_.0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......l..............Note:.....QCLuceneResultWidget......d.}"~.g...........Search Results.....QCLuceneResultWidget.....,d.}"~.g.N_..^vN.[.et..V.N:..e.hckcW(..}"_............VThe search results may not be complete since the documentation is still being indexed!.....QCLuceneResultWidget..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9301
                                                                                                                                                                                                                          Entropy (8bit):5.80411750798786
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:4bgIXwsL78BQp4dRDP0ludqODa/wkB/tTWn5dJ6mO8IZiT9Dzz/wI3HyRWqUqS:lI/oS4dR5c/tTWn5/EZA9D/w+H8WqUqS
                                                                                                                                                                                                                          MD5:47C3328D3918CF627112BB6C50E30B86
                                                                                                                                                                                                                          SHA1:05705603AB3F28402A6C103E1C41DDFF21D140C0
                                                                                                                                                                                                                          SHA-256:3697F1660D7F2AC9B37AC33CD1C7ECAE08ADBD26710E7E0076497CCDDC8BC830
                                                                                                                                                                                                                          SHA-512:8DE1C3C5A48965CF6D8AA545DA9F0A5C00AE124F3E4153597915E7C0F4CAE1E26723270F58A47AA9FFA4AAF30E6EBA522D4EBAD27DECF17EF108E353E611980E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......zh_TWB......I....[.%.......0T......0T......Uj......Uj....R.`.....>.a[....................g..t....7..@......................39.......s................... .........B<s.....B<s.....B\>......MQ..........[...J...]..31.....+.s...c.0.....U.O5Q......)Q...C..o>.......................J...............t...3...t.....8dz.....D ....R.D ......k.A.....k.A.....k.N...'...n.......I.......I...........[..2....x..G........N......w................!...........:...........Q...&...............$a......6.>...I.......L.......$..K......................_Xa...y..GA...O..GN...........$..........TH...I.K.H................ Y..pA...K..pN.............P.~.....o.....D.~.q......>.............~......~........%c.. ..o.....!.z.q...........#..0q....................i..!Y....(..g.S..f/V.p.N.W(^.z.e.N.v.}"_.uvN-0............M(The reason for this might be that the documentation is still being indexed.).....QCLuceneResultWidget......P..;............Note:.....QCLuceneResultWidget......d.\.}Pg...........Sea
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):3.6255640074603277
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/IrLlAlHekfK/gp1MUXaMlI+rwtbWlMiayIPldkOgn:CwDrC+TYIUrIRt6HoiHn
                                                                                                                                                                                                                          MD5:5A46979B45C67DD6312F33CCEA2ED7BC
                                                                                                                                                                                                                          SHA1:4C56836B1FB10D9903B299CBCB925947D515B4C8
                                                                                                                                                                                                                          SHA-256:BB246AABD501E14CED8B1FFC1369E3D5D26567AAE62B3EAD4D94C22FB77C3471
                                                                                                                                                                                                                          SHA-512:BDBA4E1731CF254E95B0F1337410937C765E96FBB1D42F1D053033E1511FEE6F50C02705F781F4DAA0347E2299DC78A5A9942AC4EA343ED1F8F401F9ACD961E4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......hu....v.....q.t.b.a.s.e._.h.u.....q.t.s.c.r.i.p.t._.h.u.....q.t.m.u.l.t.i.m.e.d.i.a._.h.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.h.u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):153
                                                                                                                                                                                                                          Entropy (8bit):3.5752972123113778
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/EbFlAlHeke5zOp1MUWLt7KlI+rwtbWlMj5FKIPldkOA9kk:CwDM+35aIUW5SIRt6Q50oi9Gk
                                                                                                                                                                                                                          MD5:2BB8C94D420D3BC344C79A01043BDC89
                                                                                                                                                                                                                          SHA1:3FBA773D58E6D3699C20AB41AEE6801E71E2DDAE
                                                                                                                                                                                                                          SHA-256:9117AAC2D07BC86DFA55A29B8825ED27C7093300FCC90E143E135E00E85F09D7
                                                                                                                                                                                                                          SHA-512:C6B13655AFB206B0056F5656B4A9BF33CC267FCC928F6973258131CFA6443970510226FE45A041E5AA988809E17D0B11C7458F4A241C71521EDED186596C6055
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......it....v.....q.t.b.a.s.e._.i.t.....q.t.s.c.r.i.p.t._.i.t.....q.t.m.u.l.t.i.m.e.d.i.a._.i.t... .q.t.x.m.l.p.a.t.t.e.r.n.s._.i.t.......
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):3.599979504080125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/il/lAlHekd6hY1MUV6JAlI+rwtbWlMgel3UlIPldkOG:Cwz4+pjUGAIRt6qVUloiB
                                                                                                                                                                                                                          MD5:8A1EE3433304838CCD0EBE0A825E84D8
                                                                                                                                                                                                                          SHA1:2B3476588350C5384E0F9A51FF2E3659E89B4846
                                                                                                                                                                                                                          SHA-256:23457CE8E44E233C6F85D56A4EE6A2CECD87C9C7BDDE6D8B8A925902EED1CD9C
                                                                                                                                                                                                                          SHA-512:2D8ACD668DF537E98B27161F9FA49828EB2EB6E9CF41DB38E7F5D31F610D150CD1B580A8AE9B472A4DFDE4D4BF983C24A56293BB911CF5879368664E4D4CF3D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......ja....v.....q.t.b.a.s.e._.j.a.....q.t.s.c.r.i.p.t._.j.a.....q.t.m.u.l.t.i.m.e.d.i.a._.j.a... .q.t.x.m.l.p.a.t.t.e.r.n.s._.j.a
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):3.652277257665055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/rrr/lAlHekcQ/01MUUQMlI+rwtbWlMhQGlIPldkORn:CwCC+1Q/UUpIRt6SBloimn
                                                                                                                                                                                                                          MD5:7B2659AF52B824EAC6C169CDD9467EE9
                                                                                                                                                                                                                          SHA1:5727109218B222E3B654A8CC9933E970EB7C2118
                                                                                                                                                                                                                          SHA-256:4CC1AF37E771F0A43898849CFF2CD42A820451B8D2B2E88931031629D781DB05
                                                                                                                                                                                                                          SHA-512:E9475AC80BDBBEFF54F2724A2B6BA76992F18FD1913FD8EE1540A99FD7A112B79FED5A130B6AC6D7460E4420C06354FC6E4CF7770A7C6CBD3EAC1BDAF0082DE5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......ko....v.....q.t.b.a.s.e._.k.o.....q.t.s.c.r.i.p.t._.k.o.....q.t.m.u.l.t.i.m.e.d.i.a._.k.o... .q.t.x.m.l.p.a.t.t.e.r.n.s._.k.o
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):165383
                                                                                                                                                                                                                          Entropy (8bit):4.805977227348512
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
                                                                                                                                                                                                                          MD5:8992B652D1499F5D2F12674F3F875A35
                                                                                                                                                                                                                          SHA1:E22766A49612F79156C550D83C6C230345DDA433
                                                                                                                                                                                                                          SHA-256:47EB5F97467DF769261421D54A5BEA1131C9FB9B6388791D38BB6574335B64BF
                                                                                                                                                                                                                          SHA-512:9B8B6DBFF432F2A46C14BC183A6BAF84ACBF02BF2C5BB8C306C6538FBD9BE1C0A9015BD46728F2F652F9163AFC56B1E16D16EB95D8F7728F3C562AE9F4F1AE1E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......ltB..0X...*..)C...+...|......P....@..9....A..9....B..:....C..:....D..;....E..;....F..<6...G..<....H..=)...I..=....P..>q...Q..>....R..?....S..@f...T..@....U..A\...V..B....W..B....X..C....Y..Cy...]..k....t..........t>......th......t.......pd...;..J'...;.._h...;.......;...{...;..J....;...)...M..l....O...R...O...............}..l9...m..lo......^S..(5..P{..+;..4...+;......+;......+O..4...+O......1...^...E@..?p..F...C...H4......HY......H.......I...D...I@..s...IA..t...IC...2..J.......J....Y..J.......J.......K...9...LD...`..L.......PS......R.......T...q...Zr...`..[`......[`..&@..\....e..\....b.._......._....P..1........E..........5........L..1...O...1...PP......7......../...........$.......$.......,.......y.......y..........K^..............x......8................L...E.......E.......E..*....................%..:....%.........0U.....W......Zo.....^....5.......0..I....0...F...0...|...0.......0.......0..+\...5...}.......... D...g.. D......+....j..,.......,.......<U...+..<U
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):89
                                                                                                                                                                                                                          Entropy (8bit):4.156834975253888
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/HzllldQlHekbxplUp1MUTJ+b:Cwv+DIUEb
                                                                                                                                                                                                                          MD5:19F1B919BB531E9E12E7F707BEBD8497
                                                                                                                                                                                                                          SHA1:46E82683CEA28D877C73A5CE02F965BB1130FC62
                                                                                                                                                                                                                          SHA-256:03467738042A15676E504BA02CB326DCDB773B171FADA3CD62B7A0E0564314A0
                                                                                                                                                                                                                          SHA-512:901D7B26CAC7A4D0FFDB39A1D25767B5BC71BED4AFBE788D70BF19D4C58A8295167111675AB45E743FDF4768AF874D69417414C01CF23D5C525A3F6C8BF7D21F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......lv....0.....q.t.b.a.s.e._.l.v.....q.t.s.c.r.i.p.t._.l.v........)....
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):161
                                                                                                                                                                                                                          Entropy (8bit):3.8693516202048612
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/5J/p/lAlHekHp/7KlI+rwtbWlM6Tl/z21MUPp/FOlIPldkOjehB:Cwr+26IRt6nFURkloiT
                                                                                                                                                                                                                          MD5:D71EA9FEFD97464B178235150EC8759E
                                                                                                                                                                                                                          SHA1:61026FE602FD1B8B442A0D341C6BD759EEC75488
                                                                                                                                                                                                                          SHA-256:BD7DD0C2CAB119A973DC10C3BFF7499D9728B928B541F86056921B30C8DB78E6
                                                                                                                                                                                                                          SHA-512:ECD76A7D8B8D733E635B2BFEA90A4CD387B83D9D8A4EB6D299F59FF22AAA8D617A4C886A825A1CDDD901925C7839E2C18BDD4E0CD84152641922B66B62663F77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......pl....v.....q.t.b.a.s.e._.p.l.....q.t.m.u.l.t.i.m.e.d.i.a._.p.l.....q.t.s.c.r.i.p.t._.p.l... .q.t.x.m.l.p.a.t.t.e.r.n.s._.p.l............,..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70334
                                                                                                                                                                                                                          Entropy (8bit):4.732724622610353
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
                                                                                                                                                                                                                          MD5:6656500F7A28EF820AE9F97FD47FB5BB
                                                                                                                                                                                                                          SHA1:CC112B9C9513BCF7497F3417168B4C8A9F7640A9
                                                                                                                                                                                                                          SHA-256:2C1E7BBF5168A64B43752DD4C547601C0BDE6D610F8671FA3E3AF38597E84783
                                                                                                                                                                                                                          SHA-512:5C3CBFCF86AF6B4D949C1D914CD379E512E73BA350AF661033A386EE7FB981FBFCB43D9A35FDE7656E17BB09F64F1469F84867A780573C3359D645269461D5A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......pt_PTB...(...*...9...+...e...]..6....;.......;..-....;..;`...;..};...;.......M..6....O... ...O...w...........}..7....m..7B..........+;......+;..8S..+;..>...+O......+O..8#..H4......H.......J......K.......LD...)..L....}..PS...l..Zr...B..[`...;..[`.....\...kU.._......._.......1...?...............8...............E............,..................p........0...............v...........%...O...%..G........4...0.......0..:....0..y....0..|....0.......0...X...5.......5...... D..=... D..Kn..+....L..,...>...,......<U..z...<U......<.......F...>...F.......H5...4..H5..=...H5..K...H5......f....p..f...1...f...;...f...I...f...|H..f.......f.......l....................b......<...............>.......L ...........`......`..._.......A......2....e...g...e..>D...e..LW................y...,.*.y.....*.y..o..*.y.....*.T..L..*.0..'..*.0....+F...y..+F......+f......+f...C..+.z..0..+.....d.+....p0.+.....R.+.z..0U.+.....u.+....8..+....Ct.+....L..+....y..+.....Z.+......+...pc.+.....+....0..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):164
                                                                                                                                                                                                                          Entropy (8bit):3.984562388316898
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/oZlAlHekF8Op1MUNKJKlI+rwtbWlM4KKIPldkOSxRMugB:CwY+GIUgcIRt61oihM3
                                                                                                                                                                                                                          MD5:F7A8C75408B9A34A2B185E76F51B7B85
                                                                                                                                                                                                                          SHA1:065E987139C5FB809A6F9CDF3845BCD79707FDBB
                                                                                                                                                                                                                          SHA-256:6492B267608C6FB76907BD8FCFC8F1EF57E9F4EBBC2E81ACA81715A88388F94A
                                                                                                                                                                                                                          SHA-512:E768C5B438EC899801B22B1325F2244ACCC5E7C2EC5D270F510BC3CBC2D9A0536949C026DB7FB5862835E506A9F2020DEB2CC4001E7011FF974324542734F855
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......ru....v.....q.t.b.a.s.e._.r.u.....q.t.s.c.r.i.p.t._.r.u.....q.t.m.u.l.t.i.m.e.d.i.a._.r.u... .q.t.x.m.l.p.a.t.t.e.r.n.s._.r.u........)......,..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):157
                                                                                                                                                                                                                          Entropy (8bit):3.7731953311404336
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/3xRlAlHekE8lgp1MUM8lMlI+rwtbWlM5UllyIPldkOfll6kchn:CwS0+t8CIUM86IRt6KUlsoi2CVh
                                                                                                                                                                                                                          MD5:24C179481B5EF574F33E983A62A34D53
                                                                                                                                                                                                                          SHA1:0A67F1ED8CA4A5182F504806F8D47D499789F2D2
                                                                                                                                                                                                                          SHA-256:B6ADFFD889FF96BF195CB997327E7D7005A815CAD67823FA6915A19C2D9BB668
                                                                                                                                                                                                                          SHA-512:4757F3693120DAB2FBB7BCF1734EA20B3E3D9056B4B4E934A3129D660CFDC6C58B230459DB55912AF24AD5692BD221830BE0FF91E41D3EECD9439E79AC23FFE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......sk....v.....q.t.b.a.s.e._.s.k.....q.t.s.c.r.i.p.t._.s.k.....q.t.m.u.l.t.i.m.e.d.i.a._.s.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.s.k...........
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228428
                                                                                                                                                                                                                          Entropy (8bit):4.726953418955661
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
                                                                                                                                                                                                                          MD5:D35A0FE35476BE8BD149CEE46E42B5E9
                                                                                                                                                                                                                          SHA1:9F3C85C115A283E5230D1EEAD84C8CB73A71FA03
                                                                                                                                                                                                                          SHA-256:C44E0313A9414CC0E490B65B0C036FA11BCA959353B228886547BC2C8492034F
                                                                                                                                                                                                                          SHA-512:BEEB1751882AF081E80BE93F7464D4C6322B724EFA2CBD3E1CBE709181D380C1C57E770FA962BB706D6FCF4A8CB393E3F6E187C1F604F8CEEFB201CA3200BD1C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......slB..<....*.......+.......@...C...A.......B...<...C.......D...2...E.......F...d...G.......H...W...I.......P.......Q.......R.......S...x...T.......U...n...V...%...W.......X.......Y.......]..g~...t...V.......f..................................;..G....;..[....;...q...;..ia...;... ...M..g....O.......O.......[..,e...........}..g....m..h........Q..(5......+;..2...+;...b..+;...i..+O..2...+O...4..1......E@......F.......H4......HY...%..H.......I.......I@......IA...9..IC......J...6...J.......J.......J...^...K...7...LD......L....n..PS...U..R.......T....=..Zr......[`...V..[`......\...!,..\...8U.._..."b.._.../h..1.......E...9......4...............5........e...................$...<...$..Z....[.......,.......y...L...y..].......H.......@.......J.......6........~..........E...O...E..+....E...~..............,1...%..8r...%...........^..............................5.......0..Gx...0.......0..P....0..h....0.......0.......5...^.......... D...... D......+....`..,.......,...-...<U
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65851
                                                                                                                                                                                                                          Entropy (8bit):4.7906769989650515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
                                                                                                                                                                                                                          MD5:0E85E0E0E7DDFE3D4BDE302F27047F9C
                                                                                                                                                                                                                          SHA1:AE59348E0C2E4F86F99DA6CF5DAB3B7E92504B7C
                                                                                                                                                                                                                          SHA-256:4B4B6FF7FD237C9DA0301B4946132E68653D15EB5FAF38E4C5FBFEBB12DD97F7
                                                                                                                                                                                                                          SHA-512:8CAAB6C61E9FA26A3A289A9E4DC515D157B3092D6D4ED43861220261BD2B7CC79B35B52F9ADE4EF558B5385B37EAC14575420DD55C475F435BB95B6C1E2561B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`...B.......*.......+...i...]..6....;.......;..-f...;..:;...;..t....;.......M..64...O.......O...........q...}..6\...m..6........(..+;......+;..7...+;..=...+O......+O..7c..H4......H.......J.......K....F..LD...+..L.......PS...N..Zr......[`...7..[`...N..\...h4.._....J.._....k..1...>...............7........}......D............,...........*......i....................................%.......%..Fc.......6...0.......0..9....0..q....0..t....0.......0.......5.......5...... D..<}.. D..I...+.......,...=X..,.......<U..r...<U...n..<.......F...=...F....F..H5......H5..<...H5..J4..H5......f.......f...1V..f...:f..f...H;..f...t&..f.......f.......l..................8......;z..............<.......Je.......6...`...&...`...!.......9......1....e.......e..=....e..J..............g...y.....*.y.../.*.y..h..*.y.....*.T..J..*.0..'[.*.0...K.+F...q..+F.....+f......+f...A..+.z../..+.......+....i`.+.....X.+.z../..+.....S.+....7..+....Bi.+....K..+....q..+.......+......+...i..+.....+....0..F0i.....G.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110
                                                                                                                                                                                                                          Entropy (8bit):3.630483009136986
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/7zl9lAlHekDN/01MULV4LlI+rwtbWlM+N:Cw5+wUGRIRt6n
                                                                                                                                                                                                                          MD5:16CDF5B9D48B0F795D532A0D07F5C3A0
                                                                                                                                                                                                                          SHA1:6E403C9096B3051973E2B681DFEBBC8DD024830D
                                                                                                                                                                                                                          SHA-256:F574A2CFD4715885C3DBDF5AE60995252673BD94FDAA9586F7E0586F6C1AC0EE
                                                                                                                                                                                                                          SHA-512:36A0431368010157EA8A45DCB00458076CCFFC08B37E443DEBD1AAD4A30C6080803337725A7A3DCBF2B410DC7BE89CEAF6C07C46F876E4EF5B08159E3BF38E6D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......tr....R.....q.t.b.a.s.e._.t.r.....q.t.s.c.r.i.p.t._.t.r.....q.t.m.u.l.t.i.m.e.d.i.a._.t.r
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):164
                                                                                                                                                                                                                          Entropy (8bit):4.021402900389864
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/ZlRlAlHekCczOp1MUKUt7KlI+rwtbWlM/cFKIPldkONRMugB:CwUl0+rjIUKUcIRt6M/oioM3
                                                                                                                                                                                                                          MD5:9B101363343847FE42167183320C03F0
                                                                                                                                                                                                                          SHA1:F0DF2CFF913E588B7CADFDABBF69F4F632B2F96A
                                                                                                                                                                                                                          SHA-256:F1621E680E1642F9463E4B07E7E78B50F9A7BDB7C321D7302039CB3405CBDEA4
                                                                                                                                                                                                                          SHA-512:DA14FDF8DB514902733CAAC492293873351C595EBBE0ACB0849BECE24AB822602EE64D01051F1426CD1FC13A95D8607302CF9B515D9806FDD3BD047087DE447C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......uk....v.....q.t.b.a.s.e._.u.k.....q.t.s.c.r.i.p.t._.u.k.....q.t.m.u.l.t.i.m.e.d.i.a._.u.k... .q.t.x.m.l.p.a.t.t.e.r.n.s._.u.k........)......,..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):117347
                                                                                                                                                                                                                          Entropy (8bit):5.8593733369029195
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:51dXW89nqEFu54aekvRzHHSVuf8j2+/xc3lhnbsfdAoz/w:v9qEFeLekvRznSVHJG3lhn+djY
                                                                                                                                                                                                                          MD5:0D02F0DE5A12BCB338B7042DFBDAACF3
                                                                                                                                                                                                                          SHA1:B7C10D249D8986AD8C6939B370407D07227A39F5
                                                                                                                                                                                                                          SHA-256:28CDE75D7B32C81FEF1D4630C37B79A61DEC24B357632FF00D6365A57D8BE43B
                                                                                                                                                                                                                          SHA-512:21F02EBA36B4411921EA3C70310B8E454E8FC2B8F09957FD6A63B71689DC381F7A5E2C3BDF2810734D659AB43D8A7BD46EF6436ECC52F75C71B5F5C313365444
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......zhB..+....*.......+.......@.......A...8...B.......C.......D.......E...V...F.......G...L...H.......I...9...P.......Q...e...R...^...S.......T...T...U.......V...|...W.......X...o...Y.......]..4 ...;...2...;..,....;..8....;.......;.......M..4H...O.......O...........#...}..4p...m..4........N..(5......+;...f..+;..6Y..+;..<...+O...8..+O..6'..1......E@......F....Y..H4..."..HY..J...H.......I.......J.......J.......K....5..LD..._..L......PS...V..Q....6..R...N...W..../..Zr.....[`.....[`......\...lU.._......._....L..1...<........j......6...............B........I...$..K....$.......,...g...y...3.......A......r...........................9..L7......;w...E..5b...E...G.......5...%.......%..D........`......*........................0.......0..8W...0..}y...0...6...0.......0.......5.......5...... D..:... D..J...+....R..,...;...,......<U..~...<U......<......F...;...F......H5...i..H5..:...H5..Jk..H5...w..VE...[..f....u..f...0X..f...9...f...E...f.......f.......f....j..g....A..l.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):141
                                                                                                                                                                                                                          Entropy (8bit):3.7198292994386235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:j2wZC4C/0N6xg/Rl/gl+kNXDelHrwtbWlMwTolIPldkOfDn:CwOO2+g6Mt63oloiUn
                                                                                                                                                                                                                          MD5:ED4135D705AEF3D97F8BF6B8FF11F09C
                                                                                                                                                                                                                          SHA1:308E2B8F74B863A61AD0B68F4A18ED06965EBEAA
                                                                                                                                                                                                                          SHA-256:751ECDA0C33E061D91241268357FBD2F6B7F70A1116E714F28D22EFD61EC7A1A
                                                                                                                                                                                                                          SHA-512:B6E6D00553A9C427130129B9D30E862028E549F372A832F0F05747C8E2A79E443F4932EC3AE177537C8BA00D26B5B6CB97D5B35426AB5229F6A468CA485BE0B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......zh_TW....n.....q.t.b.a.s.e._.z.h._.T.W...$.q.t.m.u.l.t.i.m.e.d.i.a._.z.h._.T.W...&.q.t.x.m.l.p.a.t.t.e.r.n.s._.z.h._.T.W
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):160017
                                                                                                                                                                                                                          Entropy (8bit):5.35627970915292
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
                                                                                                                                                                                                                          MD5:A7E4D0BA0FC5DF07F62CC66EC9878979
                                                                                                                                                                                                                          SHA1:21FD131B23BDD1BBA7BBB86F3ED5C83876F45638
                                                                                                                                                                                                                          SHA-256:E03FE68D83201543698FD7FE267DD5DFC5BFD195147E74FF2F19AC3491401263
                                                                                                                                                                                                                          SHA-512:D9E6B10506FCF20B5B783F011908083D9DF6C5DF88E21B10D07F53A01AD6506A4B921C85335A25BAE54E27BAD7D01B6E240D58FDEEAABC7FF32014EC120C2ECF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......arB..2....*.......+.......@.......A.......B..._...C......D.......E......F.......G... ...H...D...I...h...P...C...Q...g...R......S.......T.......U.......V...x...W......X.......Y.......]..'=...s......t...........]...........;..'....;..(....;.......;.......M..'e...O.......O...9...........}..'........C...=......m..'....t..........!o..(5...Z..+;..5u..+;..c...+O......1...!...D@...8..E@.....H4...,..HY..QI..H.......IC......J....1..J.......J.......LD......L.......PS......QR...R..R...V2..T.......U....]..X.......Zr.....[`......\....t..]x......_......._.......yg......1...6....E..8V..............C............................$..RN...[...0...,.......y.......y...................K...........9..R....E.."............z.......................%..F;...D...[..................................!....5.......0...I...0.......0...5...0..#....5.......5...p..............W}.. D..(... D..P=..+.......<U......<U......<.......H5..(...H5..P...L.......VE......VE......V....B..f...JJ..f.......f.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):165337
                                                                                                                                                                                                                          Entropy (8bit):5.332219158085151
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
                                                                                                                                                                                                                          MD5:660413AD666A6B31A1ACF8F216781D6E
                                                                                                                                                                                                                          SHA1:654409CDF3F551555957D3DBCF8D6A0D8F03A6C5
                                                                                                                                                                                                                          SHA-256:E448AC9E3F16C29EB27AF3012EFE21052DAA78FABFB34CD6DFF2F69EE3BD3CDB
                                                                                                                                                                                                                          SHA-512:C6AE4B784C3D302D7EC6B9CE7B27DDAF00713ADF233F1246CD0475697A59C84D6A86BAA1005283B1F89FCC0835FD131E5CF07B3534B66A0A0AA6AC6356006B8F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......bg_BGB../....*..,....+..."...@...]...A.......B.......C.......D...P...E...!...F.......G.......H.......I.......P.......Q.......R...A...S...e...T.......U.......V.......W...1...X...U...Y...y...]..,....s...,...t...................P...;..+....;..-E...;..!....;..+....M..,Y...O...,...O...........*...}..,............=...Q...m..,....t...|......>...(5..1...+;..<...+;..o...+O...r..1...>...D@......E@......H4......HY..[...H.......IC......J....E..J....X..J.......LD......L....L..PS......QR.."...R...`...T....X..U.......X.......Zr...q..[`...`..\.......]x......_......._....T..yg.....1...=....E..?...............L(.......(...............'...$..\....[.......,...I...y...!...y...................S...........9..]%...E..5p...........z..!q...................%..O....D..................D.....8......:......?....5...&...0.......0.. ....0...c...0..5....5.......5..................b:.. D..-... D..Z...+.......<U......<U...0..<.......H5..-...H5..[...L.......VE..#a..VE..;...V.......f...T...f...!..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Qt Translation file
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):210159
                                                                                                                                                                                                                          Entropy (8bit):4.666388181115542
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:P/DVhdlafzvZfeW+6kXEVjSVPzC3ceKdP2:xYf7UW+WjwP2
                                                                                                                                                                                                                          MD5:B383F6D4B9EEA51C065E73ECB95BBD23
                                                                                                                                                                                                                          SHA1:DD6C2C4B4888B0D14CEBFC86F471D0FC9B07FE42
                                                                                                                                                                                                                          SHA-256:52E94FCC9490889B55812C5433D009B44BDC2DC3170EB55B1AF444EF4AAE1D7F
                                                                                                                                                                                                                          SHA-512:9401940A170E22CE6515E3C1453C563D93869A3C3686C859491A1F8795520B61BF3F0BFE4687A7380C0CC0C75E25559354FDB5CEF916AF4C5B6CD9661464A54A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:<.d....!..`.......caB..7....*.......+.../...@..:P...A..:t...B..:....C..:....D..;=...E..<....F..<Z...G..<~...H..<....I..<....P..>....Q..>....R..?....S..?R...T..?v...U..?....V..?....W..@....X..@<...Y..@`...]../....s..1....t..........2s......#p...;.......;../....;..W....;..e+...M../3...O.......O..9.......J....}../]......8....=..9....m../....t..9Y.......S..(5..lB..+;.._...+;...=..+O..U...1.......D@..:...E@..?...H4...J..HY..~...H..."...IC...0..J....W..J....0..J.......LD..!...L...!f..PS..)...QR.."...R.......T...9~..U...9...U...z...X...>...Zr..E...[`...e..\...LD..]x..7U.._......._...M...yg..f...1...a....E..c....7.........U.......p........b.......4.......K...$.......[.......,.......y.......y...................^...........9...:...E...s...... (...z..":.......d......!....%..tQ...D.."......."......2......ve.....y...........5..#H...0...\...0..W+...0..';...0.......5..(....5..........)s.......... D..0w.. D..}...+...1...<?..5x..<U......<U..5...<...6@..H5..0...H5..~...L...9...VE..$...V...SV..f.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):271
                                                                                                                                                                                                                          Entropy (8bit):4.627093215673309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SoSvYFyMXS/qdadew7mZ6ALNCpvdYZ4un:kUFuT7mZlCpFw4u
                                                                                                                                                                                                                          MD5:EED4002FFE913424133D8F19FDF1C2A8
                                                                                                                                                                                                                          SHA1:F232D4C5ACF73885D8E0D70418FB2E1481D9271B
                                                                                                                                                                                                                          SHA-256:FF583A5874BE8F848E73C2F61B3A71680995926479C9BC436E6565C5CCE7CA07
                                                                                                                                                                                                                          SHA-512:115F32B21E99DEC9B50C766CC685F9387A0D0C1611A41540CA23B71579E2963E04A1E940C6C8F3447A26006DBC45F17013A7FFE97BE620B74F1CF20A21505B8E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# flake8: noqa..import os..import sys....if sys.version_info[:2] >= (3, 0):.. def exec_file_wrapper(fpath, g_vars, l_vars):.. with open(fpath) as f:.. code = compile(f.read(), os.path.basename(fpath), 'exec').. exec(code, g_vars, l_vars)..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1138
                                                                                                                                                                                                                          Entropy (8bit):4.943391541348593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:7TYCO6HEqbPo5d1i0N0QhKNAhno3oBoIVbOXono6RnZB:gKkLdzN0QhKNuniM5iC/r
                                                                                                                                                                                                                          MD5:12A5274D62FDACE8465D52F6216676EC
                                                                                                                                                                                                                          SHA1:EA9F4F5C2BE9527B825D6B38C0DC4BF8DB5965DF
                                                                                                                                                                                                                          SHA-256:FB87662AFF127BA738E73C04AE3DF9CEE5B02F3C64BCC3EAAABEEC68FF16EF8A
                                                                                                                                                                                                                          SHA-512:502744A0C9B22437F9D0C0D9CD4019C08DD913ED2A50B6C60A6776B8F4720DF5CF1EBAC6AFFB9553FE89FB5C8CDD635576D301F76AA34C09EF4D6A35026F394C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:__all__ = []....import numpy as np..import cv2 as cv..from typing import TYPE_CHECKING, Any....# Same as cv2.typing.NumPyArrayGeneric, but avoids circular dependencies..if TYPE_CHECKING:.. _NumPyArrayGeneric = np.ndarray[Any, np.dtype[np.generic]]..else:.. _NumPyArrayGeneric = np.ndarray....# NumPy documentation: https://numpy.org/doc/stable/user/basics.subclassing.html....class Mat(_NumPyArrayGeneric):.. '''.. cv.Mat wrapper for numpy array..... Stores extra metadata information how to interpret and process of numpy array for underlying C++ code... '''.... def __new__(cls, arr, **kwargs):.. obj = arr.view(Mat).. return obj.... def __init__(self, arr, **kwargs):.. self.wrap_channels = kwargs.pop('wrap_channels', getattr(arr, 'wrap_channels', False)).. if len(kwargs) > 0:.. raise TypeError('Unknown parameters: {}'.format(repr(kwargs))).... def __array_finalize__(self, obj):.. if obj is None:.. return..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):38
                                                                                                                                                                                                                          Entropy (8bit):3.968211974414884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:1LT2QbQNQ4yL9v:1LT2Q8NQ4yJ
                                                                                                                                                                                                                          MD5:C6B0244719659C5EDEC0592AF112032A
                                                                                                                                                                                                                          SHA1:6BD926FE0C853A9938BDB5D9537BD88FD1EF5401
                                                                                                                                                                                                                          SHA-256:495BD79594CCE174673E372C85C4DD8F4FFDF2B3A73FD4623955B0D55DE0D462
                                                                                                                                                                                                                          SHA-512:28D80015309AC1AE19F048E9461D4D04B85CE16B9E68C58D7608351A39B8D3EC0235FCCFD928B0349082C702D890B6C6ABD36B8030A176BF05888AE8C493B545
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:from .version import get_ocv_version..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):95
                                                                                                                                                                                                                          Entropy (8bit):4.525707419533802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:JS4iydoKE4yLYfg+4zxNG364yLA9E5HJwv:mIXE4y0YpE6405pwv
                                                                                                                                                                                                                          MD5:2D3125F1843A670B9F3229A7BC362816
                                                                                                                                                                                                                          SHA1:E884BC3D05E5E732D1308DE67AA5F96BBF4FC69F
                                                                                                                                                                                                                          SHA-256:C93A418793FCB15B9B4316C0741B8336740E490E94F3B7D1EBE8CD5F6F23815C
                                                                                                                                                                                                                          SHA-512:BFDCF6BFC1D82E3ACAF625B5940CA169784427712F14895FD6CA92CC9C864F1A894FECF97BF2AFA6FC5CF4ABA9738A302D30024BC192F85025989C0D93A8B540
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:import cv2......def get_ocv_version():.. return getattr(cv2, "__version__", "unavailable")..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26314752
                                                                                                                                                                                                                          Entropy (8bit):6.591317626319441
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:4WuFNpujlgPA/ujrrZSmB/vb3ty2vKqNn93NN6Yy2fR5yWoVx:4LvujlNujrrZ3vrLnp76Yy2psWWx
                                                                                                                                                                                                                          MD5:CB4DB51EE9A423E6168B9D08BEE61EFC
                                                                                                                                                                                                                          SHA1:C4D4CEEF485F76EF33780AE9CB7D636BC8C09539
                                                                                                                                                                                                                          SHA-256:969A3219854B6B654A7E5A89CCDB87F3CC143AF5E43858EEA0AD9275237EA406
                                                                                                                                                                                                                          SHA-512:37D239A7A1171EDA91351FFF0A076B3A38249F2D40849EBF4B5F9302CA44F4B34144F318A422F419F3F89B2EE81BEE3757AA1D979C90FD1F90001FC9B082D4D6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."..."..A......n..P..........p.....................................&........ .................................................p*...P..8.......D............`..................................(...................L................................text.....A.......A.................`.P`.data........0A.......A.............@.`..rdata..p.>...F...>...E.............@..@.rodata............................@.P@.pdata..D..........................@.0@.xdata...............x..............@.0@.bss.....l............................`..edata...............<..............@.0@.idata..p*.......,...>..............@.0..CRT....`....0.......j..............@.@..tls.........@.......l..............@.@..rsrc...8....P.......n..............@.0..reloc.......`.......r..............@.0B........................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5312
                                                                                                                                                                                                                          Entropy (8bit):5.151212669340542
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:c9ACTXc/yidAKdpJktF8O7wDpHGN5RME0Kdc:c3zji+KI+RcRME0N
                                                                                                                                                                                                                          MD5:463A64D02EC0FCDE83ACD069B3A1CE99
                                                                                                                                                                                                                          SHA1:76AA3B96BB58848C2E1262CE4C08809F931635D0
                                                                                                                                                                                                                          SHA-256:22388B3F92EE622782C38FD278296520742955B9D09BF51F128904D7B5519898
                                                                                                                                                                                                                          SHA-512:E621A22CF65D93920DE97FCD6C43F8FA46986081C7B303A6F75EF97B3C60AE134B75FDDAE4B3FA18736AE5949F743CD284E811ED98C62119D7DC81DD3F41B1CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:__all__ = [.. "IntPointer",.. "MatLike",.. "MatShape",.. "Size",.. "Size2f",.. "Scalar",.. "Point",.. "Point2i",.. "Point2f",.. "Point2d",.. "Point3i",.. "Point3f",.. "Point3d",.. "Range",.. "Rect",.. "Rect2i",.. "Rect2d",.. "Moments",.. "RotatedRect",.. "TermCriteria",.. "Vec2i",.. "Vec2f",.. "Vec2d",.. "Vec3i",.. "Vec3f",.. "Vec3d",.. "Vec4i",.. "Vec4f",.. "Vec4d",.. "Vec6f",.. "FeatureDetector",.. "DescriptorExtractor",.. "FeatureExtractor",.. "GProtoArg",.. "GProtoInputArgs",.. "GProtoOutputArgs",.. "GRunArg",.. "GOptRunArg",.. "GMetaArg",.. "Prim",.. "Matx33f",.. "Matx33d",.. "Matx44f",.. "Matx44d",.. "GTypeInfo",.. "ExtractArgsCallback",.. "ExtractMetaCallback",.. "LayerId",.. "IndexParams",.. "SearchParams",.. "map_string_and_string",.. "map_string_and_int",.. "map_string_and_vector_size_t",.. "map_string_and_vector_flo
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Python script, ASCII text executable, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):344
                                                                                                                                                                                                                          Entropy (8bit):4.438685267245838
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:1zBhJDyTH2XE2OTH2XRxEMGMBrMhWcROEoiZAIfH2Xc10F9vSumHcROEoiZWf:1zBHyLkOLejrMYccRIfh0FNSfcct
                                                                                                                                                                                                                          MD5:952D77A31C0171AE90C0086AA8E3FCC7
                                                                                                                                                                                                                          SHA1:000D22FD5A2545CEFBBF294D63415E82E232820A
                                                                                                                                                                                                                          SHA-256:2B16990B35B569AF1CA7239DC10F7B24EC62F27A46626B1E2F1271D2E1AA3554
                                                                                                                                                                                                                          SHA-512:36E5BEA12CDF8AE29D737F7062923AE4A1DBDB2C98904F9A35559222119FAFA836C4A7553F5CD9F5639043183155F5E93DFE731EBCF385349A8E4CA72D2E92B6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:from collections import namedtuple....import cv2......NativeMethodPatchedResult = namedtuple("NativeMethodPatchedResult",.. ("py", "native"))......def testOverwriteNativeMethod(arg):.. return NativeMethodPatchedResult(.. arg + 1,.. cv2.utils._native.testOverwriteNativeMethod(arg).. )..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):96
                                                                                                                                                                                                                          Entropy (8bit):4.586374127148575
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:K2T2Q5Lh4eEi+gI/aIysi+gIgZPGXV:K2TbVh4eIgMaDR1CV
                                                                                                                                                                                                                          MD5:FC16A0FD28A5C2C13D29AE4858551AB5
                                                                                                                                                                                                                          SHA1:012E90A5403FA22C9D5D62C558871758313E9186
                                                                                                                                                                                                                          SHA-256:526DE7A7E12808572EC8EE66473282958DEB5ACF419CC9B17220330DFB4D62B8
                                                                                                                                                                                                                          SHA-512:708384970CD9A388D8A6C50B84DA9EF13BC1BCAF7DB24995D459044BFCCC2B3FAE251C32E0F0CC125F18D26CBCFB0E8CC3F94DCDE754BE6B3C6B642946400C96
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:opencv_version = "4.9.0.80"..contrib = False..headless = False..rolling = False..ci_build = True
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3399200
                                                                                                                                                                                                                          Entropy (8bit):6.094152840203032
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
                                                                                                                                                                                                                          MD5:CC4CBF715966CDCAD95A1E6C95592B3D
                                                                                                                                                                                                                          SHA1:D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
                                                                                                                                                                                                                          SHA-256:594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
                                                                                                                                                                                                                          SHA-512:3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32792
                                                                                                                                                                                                                          Entropy (8bit):6.3566777719925565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
                                                                                                                                                                                                                          MD5:EEF7981412BE8EA459064D3090F4B3AA
                                                                                                                                                                                                                          SHA1:C60DA4830CE27AFC234B3C3014C583F7F0A5A925
                                                                                                                                                                                                                          SHA-256:F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
                                                                                                                                                                                                                          SHA-512:DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):689184
                                                                                                                                                                                                                          Entropy (8bit):5.526574117413294
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
                                                                                                                                                                                                                          MD5:BC778F33480148EFA5D62B2EC85AAA7D
                                                                                                                                                                                                                          SHA1:B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
                                                                                                                                                                                                                          SHA-256:9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
                                                                                                                                                                                                                          SHA-512:80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):38168576
                                                                                                                                                                                                                          Entropy (8bit):6.305082264196138
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:196608:O99XmuJ2l6d6iET5BH6ZCy1iMq5NV2OzPWJAt+bOzPWVa+llOzPWIqzfr2V9EwS6:0OzPW5OzPW5OzPWIDMD9K6LSn1ZP
                                                                                                                                                                                                                          MD5:5E46C3D334C90C3029EB6AE2A3FE58F2
                                                                                                                                                                                                                          SHA1:AD3D806F720289CCB90CE8BFD0DA49FA99E7777B
                                                                                                                                                                                                                          SHA-256:57B87772BF676B5C2D718C79DDDC9F039D79EC3319FEE1398CC305ADFF7B69E5
                                                                                                                                                                                                                          SHA-512:4BD29D19B619076A64A928F3871EDCCE8416BCF100C1AA1250932479D6536D9497F2F9A2668C90B3479D0D4AB4234FFA06F81BC6B107FAD1BE5097FA2B60AB28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.D........& ...$.....x......P.........{..............................`........F...`... ......................................P..Xe...................p...$...............V.............................(...................|...P............................text...............................`..`.data....,..........................@.`..rdata...L... ...N..................@.p@.pdata...$...p...&...X..............@.0@.xdata..p#.......$...~..............@.0@.bss.....~............................`..edata..Xe...P...f..................@.0@.idata..............................@.0..CRT....`............"..............@.@..tls.................$..............@.@..reloc...V.......X...&..............@.0B/4...... ....`.......~..............@.PB/19.....Y....p......................@..B/31......_...P...`...`..............@..B/45.................................@..B/57.....
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):65024
                                                                                                                                                                                                                          Entropy (8bit):5.994058285005393
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:NVKE5GHks9RpvRcvSDGbVPEH5YyCOawtvneP2FGsKuKgPEhmCyxF72a:NVteLpaVsH97tveP2FC5gbCGFv
                                                                                                                                                                                                                          MD5:46A229F9C54C0F0211325DCC3826ACA9
                                                                                                                                                                                                                          SHA1:E746610BA4DAD9CC9E731655104FA5B017CED543
                                                                                                                                                                                                                          SHA-256:7DFF04E2A5BF5EA15535B897DB792BF3B7AD1591FEA919C15B4E9DBD4C5F67C6
                                                                                                                                                                                                                          SHA-512:21DCB83213802082FD266E7634DFE5933DEF4BDF964B32C8769B75063AF763D9DB0000B7ED34327D9D3B46572BDE70492D6000E2380849436878F37646BC2BCC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........T..............................................@.......6....`.........................................0........................ ...............0......P...............................p...8............... ............................text.............................. .P`.rdata..29.......:..................@.P@.data...............................@.P..pdata....... ......................@.0@.reloc.......0......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2834432
                                                                                                                                                                                                                          Entropy (8bit):6.6311576070873945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:YZrpn16VCAjPsYazDMjycgtQBAUZzo4qCY4zl+vKdB+K:YZBAjO/Uup2+vKdp
                                                                                                                                                                                                                          MD5:F5604FE675F54E081A2E522461371670
                                                                                                                                                                                                                          SHA1:5430BD0FE7AB9ABAB2BA657A603485A105C325D4
                                                                                                                                                                                                                          SHA-256:174FA7B850775F0224764BB754D4C0CA5515885480AAC14A08A2EA8C305AAC16
                                                                                                                                                                                                                          SHA-512:584C7F8510384E8095AFC3008A84DA38FC3ADA4DE4E8CBF14F1A6EB83B2180EDBAE1353A8BCC249DC89F6C5516C84B1EA8DD5F8FC8AC91BBF95628F4077837B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...... .........t. .......................................-......>,...`.........................................`@'.p....@'.,.............+.h............P-..$...d%............................. e%.8............. ..............................text..... ....... ................. .P`.rdata....... ....... .............@.P@.data....!....'......^'.............@.P..pdata..h.....+......|).............@.0@.reloc...$...P-..&....+.............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110080
                                                                                                                                                                                                                          Entropy (8bit):6.155785393782448
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:8YD9m9yyTZOXZtTZS6royKDaGW2A8wWYpdC4J9u2+:8YD4rVOXnVSLyKe/21wW2z7
                                                                                                                                                                                                                          MD5:715BE8257D3D4717F0FCCD54B04E8563
                                                                                                                                                                                                                          SHA1:988F23AD08647713A1C7D08EB55D00BF35D9E647
                                                                                                                                                                                                                          SHA-256:2F2049F9EE05AECDFC59BE6EF059C5F97B2B6BDEBE5E27FDD431AD67F788D8D7
                                                                                                                                                                                                                          SHA-512:5973A365C5C8ED35F1AA5CCD06FB2A346092C8D97544FD31CA80C7F9F1B2C0C057F5661C676E69D50A2609B1DC5B98344D16FA2F6A24FB1CA8FC76C553B5FB4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....|..........`................................................d....`.............................................t.......................................<.....................................8............................................text....{.......|.................. .P`.rdata..h........ ..................@.P@.data...............................@.P..pdata..............................@.0@.reloc..<...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106496
                                                                                                                                                                                                                          Entropy (8bit):6.29508015660015
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:fl/0h7pqMLGrm19IlDiBLlJb+GBKlT51addBCQUo5+QzJocQ7JQWAPiP:ql4vkBLlJb+AKlT4rso5+QmchWAPi
                                                                                                                                                                                                                          MD5:DB7697C1626D30E98EABF9822FB8A088
                                                                                                                                                                                                                          SHA1:35AAE7BB6F45546006D9EEB6B482FC115B8CBC2F
                                                                                                                                                                                                                          SHA-256:3327E82005D1259BBECE28122C75A4E83BB508EE0CD62114ADC285F21AE89365
                                                                                                                                                                                                                          SHA-512:BC4B9A0114BAC52F19CA3BA1261B1A95553FE21899AAF51F0D63D4383EEF8FD8979F8AB697D384117D170A2EEC4D75AA8BA6AA313D82A3875C32F2B00A0F820D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....N...T.......R..............................................).....`.............................................h...(........................................u.............................. u..8............`..(............................text....M.......N.................. .P`.rdata...5...`...6...R..............@.P@.data...............................@.P..pdata..............................@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):257024
                                                                                                                                                                                                                          Entropy (8bit):6.379029212539396
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:wewkgh4gwSIdtALZrZ6LK5zyfn5jwT9X8zcKzDWV:0G6LT6R5jwOcl
                                                                                                                                                                                                                          MD5:BDD5DB8721C48DF94B9D7211F8ACC5F8
                                                                                                                                                                                                                          SHA1:314DA2C2978F43840F641FD6274177E4B0AF9047
                                                                                                                                                                                                                          SHA-256:1D5C98F95ABC2C87533237B1200E14539B7C5D8F1BF90870C15CFC00D51097FF
                                                                                                                                                                                                                          SHA-512:29874CDA6595BD908C54A67C43BB8AD7B0D17BA1895650605D42B580A573395BFD4BF49453396AE131F192D2AB92627CF67667BE19573FA6D79A39401C173033
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....2...........6.......................................@.......'....`............................................. ...0...x............................0..P......................................8............P...............................text....1.......2.................. .P`.rdata..l....P.......6..............@.P@.data...............................@.P..pdata..............................@.0@.reloc..P....0......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174080
                                                                                                                                                                                                                          Entropy (8bit):6.105176064620869
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:hAyDLu/gTyqWqDOUi9a0h70q7jEZMDt7knNr1z4OSf2xIVUKTZap:hAy/uoTyRaA9jxDhG1z7LKNa
                                                                                                                                                                                                                          MD5:075B073473A9529D0DBC2CBAC637CE09
                                                                                                                                                                                                                          SHA1:903E1768A7A943A4FCFC122DC903F21ECD86C0E3
                                                                                                                                                                                                                          SHA-256:48BF0E11F32DC18D4AE4BBA02F952A21A167573326AE6DA1A87DDDD9349EC86C
                                                                                                                                                                                                                          SHA-512:A8C2FB6E976EC26A11D5E2E1D23F1DF59FFB71B7F5AE3983382CCEE9BF256622C5FF27938FB5DB4780E5BE26F4EE2C749FFB8DA594C84990581A54D4B68D961D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....8...l.......<....................................................`......................................... ...\...|...x...................................P...............................p...8............P...............................text....7.......8.................. .P`.rdata..dW...P...X...<..............@.P@.data...............................@.P..pdata..............................@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):694272
                                                                                                                                                                                                                          Entropy (8bit):6.313719191343553
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:q2/4/rpBYL6PYFaK76nBisdLRxfxUOmxm+K+jwjT:R/4zpBYjFqlRxx+Kek
                                                                                                                                                                                                                          MD5:F193FDAFA9DB9A528B12EDAD61CC6E00
                                                                                                                                                                                                                          SHA1:8A9C7E78035F864102A3D84886D107539B3BAEFC
                                                                                                                                                                                                                          SHA-256:99F57F0EC077F5CF3AEF47AA2EF5291964F74BE5D73851F63C7FD15B87C31CBE
                                                                                                                                                                                                                          SHA-512:A8E317A120481D84D123283D68ED25B181E3BAF5708A90C1980B53444419DA30A305122B817A3A05EC5305676010884C54DCA4103B82B4CA91D0EB83F38D724D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....6...^.......:...............................................M....`..........................................P.......X..................................h....%...............................%..8............P...............................text....5.......6.................. .P`.rdata...#...P...$...:..............@.P@.data...h9...........^..............@.P..pdata...............v..............@.0@.reloc..h...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):77312
                                                                                                                                                                                                                          Entropy (8bit):6.190129520453749
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:tX2z8GmDtvm2B1/FuHWIx68XTWbDdCmdVBEZhrAOT:tGz8GKjJG68XQmXrAO
                                                                                                                                                                                                                          MD5:B15E49985A36102A282F4655D2115DE2
                                                                                                                                                                                                                          SHA1:5CC2BF51E40738DABDFFF5384C44398101777DCA
                                                                                                                                                                                                                          SHA-256:B7B81EF1DF9952651C3473FD7D640D79B0524192050AE9BB8E2AB71E8EED3212
                                                                                                                                                                                                                          SHA-512:30A1BC3D4FA27A5FDA2FC4DDE71F9A545A690BAD1FD66C417C13E48918597F0E0DACA88CA4A301B11457CA47746851FB70D2635C67722777BAAC0505DDCEC864
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........f......P........................................p............`..........................................%..`....&..x............P...............`..|... ...............................@...8............................................text............................... .P`.rdata...W.......X..................@.P@.data...H....@....... ..............@.P..pdata.......P.......$..............@.0@.reloc..|....`.......,..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):84480
                                                                                                                                                                                                                          Entropy (8bit):6.065331568083205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:sxDenRFCSmTV6rIuKX1hJ6K7fkVxi0IE5nnmF/h:sZaFCSmTNRX1hQKTW5nnmF
                                                                                                                                                                                                                          MD5:C2A8002BF0AA62E0BFE0F1E938A12EF6
                                                                                                                                                                                                                          SHA1:AD15A572D51F628757F227F881E004052A93A193
                                                                                                                                                                                                                          SHA-256:C67705D6D3843A3656A8CD6EEDAC62C2B4209D3F801A92F3B2B5000A75600B8A
                                                                                                                                                                                                                          SHA-512:B3FBD58CAE741C00A14AD630FFACDA5FA9F74BF6E558A7E8ECDD7418A131F7F615220DB042BB55939E7CF754FA9CB6AD4CA19F8B7DA39FD64F507B22E90D5907
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........t............................................................`.........................................`?..\....?..x...............8................... 3..............................@3..8............................................text...8........................... .P`.rdata..fa.......b..................@.P@.data........`.......8..............@.P..pdata..8............@..............@.0@.reloc...............H..............@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70656
                                                                                                                                                                                                                          Entropy (8bit):6.054105449649638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:konm5wl9AXmpixdR9GrC2DZFEmW+4QqX2G7b5td2ETmSS:kvw3AsrC21zWDHNb5tdZTmSS
                                                                                                                                                                                                                          MD5:18E0B9676B9724A3931491828966BEB2
                                                                                                                                                                                                                          SHA1:0C8846DFDB2900268009042DD53DFF90570096D0
                                                                                                                                                                                                                          SHA-256:73E35656E4E26137F771FDDADB1B7A806FA8399BFA8ABB66B63E1A9EDE809D18
                                                                                                                                                                                                                          SHA-512:5E4DCBA88657BC099AC6BD43C46FBD88AEF42E8F7EC3698CFB8334FFC46E5F12D0B74B2E8B00297A8F2FB943ACCF123DEBBEA384CB4DA8CEDAA3C764DE86B49E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........`......P........................................P.......K....`.............................................\...\...x............0...............@..|.......................................8............................................text............................... .P`.rdata..\S.......T..................@.P@.data...(.... ......................@.P..pdata.......0......................@.0@.reloc..|....@......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):51712
                                                                                                                                                                                                                          Entropy (8bit):5.886300247740077
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:4W5V7Yiy8/X0y86nnABveaLxl+Ek9Swj73Uw8w8SHyuUAa8oPHGcFSgxEdkBBc:4AVFF0an8VlXvwMtfDXGOxEdWc
                                                                                                                                                                                                                          MD5:EEECD86BE89A4944A7FC0569F31A48EC
                                                                                                                                                                                                                          SHA1:572F70ECA1FB29D9B12CC4BB3278309D0DD3AABC
                                                                                                                                                                                                                          SHA-256:5F778438D9BFC32B4AD3CB0EF7182AF098504A081AA5E17DB077CF424DAE8D42
                                                                                                                                                                                                                          SHA-512:3F3566734D6BD057231253B026B41DC3AE8F6EA579EE54A58C18D1AD66F8CDDBC3785C3A234FFA5F5CB9D3E1CA4EFAD1CB8B9728C4E3473DACE0F00B68033D09
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....|...J......P....................................................`............................................\...,...x...............................p......................................8............................................text....{.......|.................. .P`.rdata...=.......>..................@.P@.data...............................@.P..pdata..............................@.0@.reloc..p...........................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):164352
                                                                                                                                                                                                                          Entropy (8bit):6.170419189874856
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:Lj6KO4lIE5h0/VrHEjQEUF6uR+UR2FRl+I9U2+Warahg2+WarahjLMSl5c9DNHaq:Lj6KO46SWdrHdF6G2vl+uU2+Warahg2m
                                                                                                                                                                                                                          MD5:B2879AF0EC91B94458E85C03C441CD14
                                                                                                                                                                                                                          SHA1:D8431B9E52277DD768666A7A20E4C5217362A980
                                                                                                                                                                                                                          SHA-256:8B7B29F63F051F93AB7BE369E7FD22CAB1385E3AAA83D7BEB3267DF4F39154AB
                                                                                                                                                                                                                          SHA-512:3DBCE2B102E2A7AD62881FF24D2446AB25DC760BD5C1AF8EE8780D08A94270D55B5754D99FCEA1E5FBF885D3789A7983177E91BA132EDFFB38274B6F45298247
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".................................................................h....`..........................................V..h...XW..x...................................PE..............................pE..8............................................text...x........................... .P`.rdata..............................@.P@.data...X$...p.......`..............@.P..pdata...............t..............@.0@.reloc..............................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):596992
                                                                                                                                                                                                                          Entropy (8bit):6.215300924489346
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:lDie19QbZGfL0DlT0U5Xc0X2bfRFAg3jwG:lNDQbZ9jjXBgT5
                                                                                                                                                                                                                          MD5:12C6AAB00309D50D5FF5E7B6877F83D6
                                                                                                                                                                                                                          SHA1:D53B321B496FF637643570A948A7238A3098BE9C
                                                                                                                                                                                                                          SHA-256:F2206738B19668BC5718D0E684890AB9A6D420AAC35D5C784D4CC35A6D520493
                                                                                                                                                                                                                          SHA-512:564E75B86AF8ED3FCCEC51F85AD5442B5B68EE70393126A61F0FF174D1D0165E427E413F8B02724DCF748A4BDFA3F1B58A5D1FBF2ADBD066BE690471DAA10673
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........*...............................................p...........`..................................................................@..\............`......P...............................p...8...............x............................text............................... .P`.rdata..............................@.P@.data...X,..........................@.P..pdata..\....@......................@.0@.reloc.......`......................@.0B........................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4
                                                                                                                                                                                                                          Entropy (8bit):1.5
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Mn:M
                                                                                                                                                                                                                          MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                          SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                          SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                          SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:pip.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):5.1315093013694835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:RsMiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:KMiJzfPvGt7ICQH+sfIte36AFD
                                                                                                                                                                                                                          MD5:8BA06D529C955048E5DDD7C45459EB2E
                                                                                                                                                                                                                          SHA1:33263B236DBFF36FC92163EC61D62B9370384FEC
                                                                                                                                                                                                                          SHA-256:5BA21FBB0964F936AD7D15362D1ED6D4931CC8C8F9FF2D4D91190E109BE74431
                                                                                                                                                                                                                          SHA-512:B556395FE3FD5E11CCE48B082C4E9799D37514D5AC0CFAEC6FEDD7C00D72EA3B9D001F8791E948253B516CC6BDA0E8663B055D6B8587D7CFA11773153834B8DE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (c) 2008-2019 The pip developers (see AUTHORS.txt file)..Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISING FROM
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3708
                                                                                                                                                                                                                          Entropy (8bit):4.978925380870447
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:DygN5jaaxmPkxsxM5wBlhLMxSbMY0Ltb63Rg6jWMy:1sMw3Rg0g
                                                                                                                                                                                                                          MD5:107AA0D8738CFFB2A4BDEF3045E30990
                                                                                                                                                                                                                          SHA1:2D9B8FE93EDBDF63B261F6CF30B94CBBE43321F0
                                                                                                                                                                                                                          SHA-256:F669873F705ECDE43088F8F5D8D74B16CA6A731AAB7FBC6A5BA397F4FC194ABE
                                                                                                                                                                                                                          SHA-512:64E12E3E8AEAAE98DD4E62104D0046B5EA6259E438C5340AAD21DDFA3273A0595FF92C7A3E2BD2894767B1D266F721E6D5A95F75A77E849855F3FC6C96929092
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Metadata-Version: 2.1.Name: pip.Version: 20.2.3.Summary: The PyPA recommended tool for installing Python packages..Home-page: https://pip.pypa.io/.Author: The pip developers.Author-email: distutils-sig@python.org.License: MIT.Project-URL: Documentation, https://pip.pypa.io.Project-URL: Source, https://github.com/pypa/pip.Project-URL: Changelog, https://pip.pypa.io/en/stable/news/.Keywords: distutils easy_install egg setuptools wheel virtualenv.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Topic :: Software Development :: Build Tools.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: P
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58156
                                                                                                                                                                                                                          Entropy (8bit):5.568921432203395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:YHcayOazPVb+5pEJ88vVe4bTd1bsccWv01uCjhVy:YHcrHVb+5pY84Ve4bTd1bscdvErtY
                                                                                                                                                                                                                          MD5:96926E5190FAA264E6C2A06FE92C4E1C
                                                                                                                                                                                                                          SHA1:BF9F2C41155DE36C51948279C07774F9A2E5AEB0
                                                                                                                                                                                                                          SHA-256:BD8C847639F746B6F8EB4CFF003B7FBEF43E82DDD1F98A0A199D46A541F6C349
                                                                                                                                                                                                                          SHA-512:E974A89C7B9965CA215C6758936EEECBF8A16640938560F7D56A519F970EF284D9AEAA08F1C44C35BFB605EFA706E4169EBC67A926813777A22F9894E460A205
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:../../Scripts/pip.exe,sha256=Esrq-uIHboffERhf5Z7Y8Phsqn9OSYVvGDPvXBG_Xwo,106376..../../Scripts/pip3.9.exe,sha256=Esrq-uIHboffERhf5Z7Y8Phsqn9OSYVvGDPvXBG_Xwo,106376..../../Scripts/pip3.exe,sha256=Esrq-uIHboffERhf5Z7Y8Phsqn9OSYVvGDPvXBG_Xwo,106376..pip-20.2.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pip-20.2.3.dist-info/LICENSE.txt,sha256=W6Ifuwlk-TatfRU2LR7W1JMcyMj5_y1NkRkOEJvnRDE,1090..pip-20.2.3.dist-info/METADATA,sha256=9mmHP3BezeQwiPj12NdLFspqcxqrf7xqW6OX9PwZSr4,3708..pip-20.2.3.dist-info/RECORD,,..pip-20.2.3.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pip-20.2.3.dist-info/WHEEL,sha256=ADKeyaGyKF5DwBNE0sRE5pvW-bSkFMJfBuhzZ3rceP4,110..pip-20.2.3.dist-info/entry_points.txt,sha256=HtfDOwpUlr9s73jqLQ6wF9V0_0qvUXJwCBz7Vwx0Ue0,125..pip-20.2.3.dist-info/top_level.txt,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..pip/__init__.py,sha256=NkPibWV383InU5x7DgeQLdL2zhlXTKjJRBMQTSKNYjI,455..pip/__main__.py,sha256=bqCAM1cj1HwHCD
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110
                                                                                                                                                                                                                          Entropy (8bit):4.816968543485036
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:RtEeX7MWcSlVii6KRRP+tPCCf7irO5S:RtBMwlViGjWBBwt
                                                                                                                                                                                                                          MD5:D25A99ECD1ECB535EE4E31874B0C7B95
                                                                                                                                                                                                                          SHA1:B80780FBBF97A5FBF433C4F692E340632EA675F1
                                                                                                                                                                                                                          SHA-256:00329EC9A1B2285E43C01344D2C444E69BD6F9B4A414C25F06E873677ADC78FE
                                                                                                                                                                                                                          SHA-512:539E072414E6E8AD3BFAEDB0587507443B39826814FB330B57D605FB5FBE61134D3548359F41A14CC63B44E23EF0AA1E62EA1C4A2F3B344BE548F4C2C8143976
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.35.1).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):125
                                                                                                                                                                                                                          Entropy (8bit):4.063179170203111
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:1VriL6MtGC8eeBK6MtGC8eeWivMh6MtGC8e3n:1VriLtofKtotKtoa
                                                                                                                                                                                                                          MD5:1717F250956AACBB7973AF030DDCC506
                                                                                                                                                                                                                          SHA1:1A6C243A1581ADA312B7C5B68790803CEB1169A2
                                                                                                                                                                                                                          SHA-256:1ED7C33B0A5496BF6CEF78EA2D0EB017D574FF4AAF517270081CFB570C7451ED
                                                                                                                                                                                                                          SHA-512:0B823A5646350663C146D64F0EED98E3A99ABF068C45ED4FF5FDD389EA58AD79BD79DA0B60A945F090B8EE87252139B33712C6B8285E5591440A3312A107E2A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:[console_scripts].pip = pip._internal.cli.main:main.pip3 = pip._internal.cli.main:main.pip3.8 = pip._internal.cli.main:main..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4
                                                                                                                                                                                                                          Entropy (8bit):1.5
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Mn:M
                                                                                                                                                                                                                          MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                          SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                          SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                          SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:pip.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):67072
                                                                                                                                                                                                                          Entropy (8bit):5.90551713971002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:ZhseNxkc7Xva0Y420G1UD+dS4gBeLmRy:Z1kcbi0Y42bUD+dS4oeiRy
                                                                                                                                                                                                                          MD5:01F9D30DD889A3519E3CA93FE6EFEE70
                                                                                                                                                                                                                          SHA1:EBF55ADBD8CD938C4C11D076203A3E54D995AEFF
                                                                                                                                                                                                                          SHA-256:A66444A08A8B9CEAFA05DAEFEB32AA1E65C8009A3C480599F648FA52A20AFB7D
                                                                                                                                                                                                                          SHA-512:76FED302D62BB38A39E0BF6C9038730E83B6AFFFA2F36E7A62B85770D4847EA6C688098061945509A1FDB799FB7F5C88699F94E7DA1934F88A9C3B6A433EE9EF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`T..$5..$5..$5..-M3..5..v@..&5..v@..(5..v@..,5..v@.. 5...k..&5..oM..55..$5...5...@..45...@..%5...@_.%5...@..%5..Rich$5..........................PE..d.....~e.........." .........h..............................................@............`.........................................P...`.......@.... .......................0..(.......................................8............................................text............................... ..`.rdata..|I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):301568
                                                                                                                                                                                                                          Entropy (8bit):6.3420350412756274
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:UWxKWIAdASHubXQV2ehNu5JBsPvotjnOG:FxKWz1hKa8nX
                                                                                                                                                                                                                          MD5:2AADB9C4E19F30CF9787B01256E36D6C
                                                                                                                                                                                                                          SHA1:EA928D1EFA8B979F826C3984A9C87CEAD525167C
                                                                                                                                                                                                                          SHA-256:5F121FE659843864E0606329D268DB7158FCEEF4C8F1FACA9C558D787BF39404
                                                                                                                                                                                                                          SHA-512:94617F55A791E545DF4ED2FC80E344017EEAF48AAA8FED17E6B41943A66AD08D0FA7205FC9CE98F5E1B3857E04D11B347891F94A8A268A715660F7A2352E7E2E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P<M%.]#v.]#v.]#v.6 w.]#v.6&w.]#v.6'w.]#vv%&w.]#vv%'w.]#vv% w.]#v.("w.]#v.6"w.]#v.]"v.]#vu''w.]#vu'+w.]#vu'#w.]#vu'.v.]#vu'!w.]#vRich.]#v........PE..d.....Ge.........." ... ..................................................................`..........................................I..d....J..................d)..................`............................... ...@............0...............................text............................... ..`.rdata..`/...0...0..................@..@.data...p2...`.......F..............@....pdata..d).......*...b..............@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188944
                                                                                                                                                                                                                          Entropy (8bit):6.316734516354951
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:PPByGzRK2iMxLo706iAJFyPMf+ImzdJclGJmRlhLblXQOlf/ITTpb26ROfuQL5UL:PUp2iMxM70afLmzdJcbtbnf/ypKLqt
                                                                                                                                                                                                                          MD5:0DC9848A5FCE6EC03799AC65602DC053
                                                                                                                                                                                                                          SHA1:DDFD97A45C0DB5117E047BF45D66873B53160978
                                                                                                                                                                                                                          SHA-256:ADC9C63F92629ED4B860FC1855400B59A1AE73DD489FD49DB326DCFCAD48550E
                                                                                                                                                                                                                          SHA-512:D1B2F71000CAB1115971D44C690FDB8966B9B402216B87EC1F1E8E8A1CCA3CE1E1145B8D650C8AD737E6E24C59503AAF9310DE3E96A0AC6596187C800013AC71
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zJXf>+65>+65>+657S.54+65.[74<+65.[345+65.[246+65.[54=+65.Z74<+65eC74=+65>+75L+65.Z;4:+65.Z64?+65.Z.5?+65.Z44?+65Rich>+65................PE..d....={_.........." .................................................................*....`.............................................P...`........................................5..T............................6..0............ ...............................text...s........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):58384
                                                                                                                                                                                                                          Entropy (8bit):5.879471644001699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:oSspSGOfpzVHBlAUcfc0la6WS6kH/ZFJ1Yu+wNBECaOMyCgUhkb0E/G88AIhV0cj:whf+kD8AIhV05yJ
                                                                                                                                                                                                                          MD5:3C88DE1EBD52E9FCB46DC44D8A123579
                                                                                                                                                                                                                          SHA1:7D48519D2A19CAC871277D9B63A3EA094FBBB3D9
                                                                                                                                                                                                                          SHA-256:2B22B6D576118C5AE98F13B75B4ACE47AB0C1F4CD3FF098C6AEE23A8A99B9A8C
                                                                                                                                                                                                                          SHA-512:1E55C9F7AC5ACF3F7262FA2F3C509EE0875520BB05D65CD68B90671AC70E8C99BCE99433B02055C07825285004D4C5915744F17ECCFAC9B25E0F7CD1BEE9E6D3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.n.l...d.n.d...d.n.....d.n.f...d.Rich..d.................PE..d....={_.........." .................................................................@....`.........................................` ............................................... ..T............................................................................text............................... ..`.rdata....... ......................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4457488
                                                                                                                                                                                                                          Entropy (8bit):6.4375658606576405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:49152:1kYH+B/E8d7YHDCxJvUIIHd4hP8wuqNdOMFit/gxSwzaBuv4lz1ZRVgwWFJfzMpg:zo7Yq0a2YaCIIzcHxJ7HtMU5weHWeMt
                                                                                                                                                                                                                          MD5:11C051F93C922D6B6B4829772F27A5BE
                                                                                                                                                                                                                          SHA1:42FBDF3403A4BC3D46D348CA37A9F835E073D440
                                                                                                                                                                                                                          SHA-256:0EABF135BB9492E561BBBC5602A933623C9E461ACEAF6EB1CECED635E363CD5C
                                                                                                                                                                                                                          SHA-512:1CDEC23486CFFCB91098A8B2C3F1262D6703946ACF52AA2FE701964FB228D1411D9B6683BD54527860E10AFFC0E3D3DE92A6ECF2C6C8465E9C8B9A7304E2A4A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................7.......QH&.....7.......7.......7........r.....................x.......x.......x.......x.......Rich....................PE..d....={_.........." ....."#..b#......O........................................F.......D...`.........................................pZ<.......=.|....0F.......D.\/....C......@F..u..4.$.T.............................$.0............@#.`............................text.... #......"#................. ..`.rdata.......@#......&#.............@..@.data........P=......*=.............@....pdata..\/....D..0...:A.............@..@.rsrc........0F......jC.............@..@.reloc...u...@F..v...tC.............@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):669696
                                                                                                                                                                                                                          Entropy (8bit):6.041318185220244
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:0JAdJvxYYlSBSEglosP1ZhDuGWpdH+czk:EAfvx1gcE6omZpuec
                                                                                                                                                                                                                          MD5:8D4CD39CF6B1E5D3743AC1BCDCAB4F12
                                                                                                                                                                                                                          SHA1:2ECFD93164920A60C273B1D000DF14351816DBD7
                                                                                                                                                                                                                          SHA-256:0789F9321ABFA3A6403A483CB3BA684DA5CFC39D26195FCE8669A77C6367C413
                                                                                                                                                                                                                          SHA-512:7734D61B7B2C5F829D05488B26D958B85D0CF87776B91E8A63B58DEBF5D32DB42BC2D203CC5A27AB426672C282BF95B41B8429EE3EA1F0E0D9CA55F9F68E77BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+.P+...+...*...+...*...+...*...+...*...+!..*...+...*...+x..*...+...*...+...+...+!..*...+!..*...+!..*...+Rich...+........PE..d...k..d.........." ......................................................................`.........................................pU...c..............\....@..0{............... ......T...........................0...8............................................text............................... ..`.rdata..|$.......&..................@..@.data....I..........................@....pdata..0{...@...|..................@..@.rsrc...\...........................@..@.reloc... ......."..................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):134656
                                                                                                                                                                                                                          Entropy (8bit):6.0017332542566715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072://ZCM+lst/TPZa4TjDY/r06trJhQAjkYe1K6SXxKpjAjfMG://ZCplst/TPnY/rxt6A4Ye1KbXYpEjf
                                                                                                                                                                                                                          MD5:F20FD2E2AC9058A9FD227172F8FF2C12
                                                                                                                                                                                                                          SHA1:89EBA891352BE46581B94A17DB7C2EDE9A39AB01
                                                                                                                                                                                                                          SHA-256:20BDE8E50E42F7AABF59106EEA238FCC0DECE0C6E362C0A7FEEB004AB981DB8A
                                                                                                                                                                                                                          SHA-512:42A86FA192AEA7ADB4283DC48A323A4F687DAD40060EA3FFDDCD8FD7670BB535D31A7764706E5C5473DA28399FEC048AE714A111EE238BB25E1AAD03E12078D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.$.X.w.X.w.X.w. Kw.X.w.-.v.X.w.7%w.X.w.-.v.X.w.-.v.X.w.-.v.X.w.3.v.X.wY1.v.X.w.3.v.X.w.X.w&X.w.-.v.X.w.-.v.X.w.-.v.X.wRich.X.w........PE..d......d.........." .........................................................P............`..........................................u..`B..p...,....0..d.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..\...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...d....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27152
                                                                                                                                                                                                                          Entropy (8bit):6.196341800261924
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:1AEYe1nJzV3mynQwhS/hHq++4XvPAr70cElZ8AIhqGLnYPLxDG4y8eKAtO:FBBDnQwhihHq2v8uZ8AIhqGLWDG4y0iO
                                                                                                                                                                                                                          MD5:7A442BBCC4B7AA02C762321F39487BA9
                                                                                                                                                                                                                          SHA1:0FCB5BBDD0C3D3C5943E557CC2A5B43E20655B83
                                                                                                                                                                                                                          SHA-256:1DD7BBA480E65802657C31E6D20B1346D11BCA2192575B45EB9760A4FEB468AD
                                                                                                                                                                                                                          SHA-512:3433C46C7603AE0A73AA9A863B2AECD810F8C0CC6C2CD96C71EF6BDE64C275E0FCEB4EA138E46A5C9BF72F66DCDEA3E9551CF2103188A1E98A92D8140879B34C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...%...%...%.......%.Z.$...%.Z. ...%.Z.!...%.Z.&...%...$...%...$...%...$...%...(...%...%...%.......%...'...%.Rich..%.........................PE..d....={_.........." ..... ...2......................................................:.....`..........................................@..L....@..x....p.......`..<....P..........@....2..T...........................03..0............0..(............................text...=........ .................. ..`.rdata..*....0.......$..............@..@.data........P.......>..............@....pdata..<....`.......@..............@..@.rsrc........p.......D..............@..@.reloc..@............N..............@..B................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4
                                                                                                                                                                                                                          Entropy (8bit):1.5
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:Mn:M
                                                                                                                                                                                                                          MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                          SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                          SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                          SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:pip.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1078
                                                                                                                                                                                                                          Entropy (8bit):5.127816565309219
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:p7rOJH7H0yxgtUHw1hC09QHOsUv4eOk4/+/m3oqLFh:RSJrlxEvdQHOs5exm3ogFh
                                                                                                                                                                                                                          MD5:9A33897F1BCA1160D7AAD3835152E158
                                                                                                                                                                                                                          SHA1:A5234543D56E03C950C0080826B53A0CB97671AF
                                                                                                                                                                                                                          SHA-256:C32A3AC395AF6321EFD28BE73D06A00F0DB6AB887D1C21D4FEC46128D2056D5A
                                                                                                                                                                                                                          SHA-512:0CC71D2F794775FE676B729532C1B5B68777CABC7FB15E0D5F38542A3D4631B211074FF86D69127E2F088CD357161CF0C353F658F640711CDCC821D4D45CB318
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Copyright (C) 2016 Jason R Coombs <jaraco@jaraco.com>..Permission is hereby granted, free of charge, to any person obtaining a copy of.this software and associated documentation files (the "Software"), to deal in.the Software without restriction, including without limitation the rights to.use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies.of the Software, and to permit persons to whom the Software is furnished to do.so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,.OUT OF OR
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4819
                                                                                                                                                                                                                          Entropy (8bit):5.0865265175094425
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:DpGYyJAmhQI/aMxmPd132n71ACA8IjqyU8BeqGpDiHVP6o7PFPMUwTeXv:DF9Gn7mZ8IjqyU8BeqG4wTY
                                                                                                                                                                                                                          MD5:0FBFE2D1A8DE08A2DD673D160AF5A360
                                                                                                                                                                                                                          SHA1:7178E12234DE06A05C99949DB5873D6B47B7B835
                                                                                                                                                                                                                          SHA-256:0695712D72E0EE815F934E51B91B8079AE093D37D8AD5097D277D6E00F52F70F
                                                                                                                                                                                                                          SHA-512:6B8D660E5C378A960385EC29CA58E9F60FCDC073C3433FD9ADE8C3C5B465B4906028E7155B7FAFDA3BEDEEBF37609D018904D49C56712C1043531EC6AA5D716C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Metadata-Version: 2.1.Name: setuptools.Version: 49.2.1.Summary: Easily download, build, install, upgrade, and uninstall Python packages.Home-page: https://github.com/pypa/setuptools.Author: Python Packaging Authority.Author-email: distutils-sig@python.org.License: UNKNOWN.Project-URL: Documentation, https://setuptools.readthedocs.io/.Keywords: CPAN PyPI distutils eggs package management.Platform: UNKNOWN.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Operating System :: OS Independent.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Topic :: Software Development :: Libraries :: Python Modules.Classifier: Topic
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:CSV text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22793
                                                                                                                                                                                                                          Entropy (8bit):5.590242412302483
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:sPUdzrUuHSo+ahtaPEkcFEU2HWvao4I6pLXB+ZIXvRNwyUvBU3yYFh9QU5HGf9oB:2eLvctfRZUv2iYFrQU5i9qV
                                                                                                                                                                                                                          MD5:C67F968859FD8DEDDF867B444ECD4398
                                                                                                                                                                                                                          SHA1:E2FE467DA10D1338C5658E1E8DA55BF40AF3CDDD
                                                                                                                                                                                                                          SHA-256:F74DC2386FDE51D0E5E4F7C01D622790EBC143B29B278190CAF4C4AE6C3C4241
                                                                                                                                                                                                                          SHA-512:BD3466855AD0FF536D4B1769EF544753FE03C0F01E53BF2CD2893F0AC9CB1E6B61C89415D5C00A3E3B548EAB181A33322915A8855889E8A13FB0F1E0E08F0EF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:../../Scripts/easy_install-3.9.exe,sha256=VEvVrEhbE_qAeziwi8dhT61IKWcXV3VQTcte3mGYBoI,106385..../../Scripts/easy_install.exe,sha256=VEvVrEhbE_qAeziwi8dhT61IKWcXV3VQTcte3mGYBoI,106385..__pycache__/easy_install.cpython-39.pyc,,..easy_install.py,sha256=MDC9vt5AxDsXX5qcKlBz2TnW6Tpuv_AobnfhCJ9X3PM,126..pkg_resources/__init__.py,sha256=44G2LkL_lXbDzjTukLmR5baLQtE3S4IaFciSZPDcOM8,108481..pkg_resources/__pycache__/__init__.cpython-39.pyc,,..pkg_resources/_vendor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..pkg_resources/_vendor/__pycache__/__init__.cpython-39.pyc,,..pkg_resources/_vendor/__pycache__/appdirs.cpython-39.pyc,,..pkg_resources/_vendor/__pycache__/pyparsing.cpython-39.pyc,,..pkg_resources/_vendor/__pycache__/six.cpython-39.pyc,,..pkg_resources/_vendor/appdirs.py,sha256=MievUEuv3l_mQISH5SF0shDk_BNhHHzYiAPrT3ITN4I,24701..pkg_resources/_vendor/packaging/__about__.py,sha256=CpuMSyh1V7adw8QMjWKkY3LtdqRUkRX4MgJ6nF4stM0,744..pkg_resources/_vendor/packaging/__init__.py,
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92
                                                                                                                                                                                                                          Entropy (8bit):4.842566724466667
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:RtEeX7MWcSlVitcv6KjP+tPCCfA5S:RtBMwlViWZWBBf
                                                                                                                                                                                                                          MD5:2295CBFB2556C76D0EB0F184F7F5E416
                                                                                                                                                                                                                          SHA1:AC049E2836CED0D89815B6A59D6FA063094EEA71
                                                                                                                                                                                                                          SHA-256:8389CCB3B77E5E5F7EC42F57A2F52BB031C65EDF854F4135ED8AA8F760C47EF6
                                                                                                                                                                                                                          SHA-512:9579F4AA5FB4131B79F1162100756459B0175521C919ACD75C74219531404191962FE56488CD0881D05FF8918720069D51CD014FFA19B96B75E1100EC7DECB49
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.34.2).Root-Is-Purelib: true.Tag: py3-none-any..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):239
                                                                                                                                                                                                                          Entropy (8bit):4.9593491706048285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:2MqdSOGVKfetEX8sEuGLRxtqdSOGR74pN6Dzqv:2qbcmEdEuudXUpN6DzU
                                                                                                                                                                                                                          MD5:6E8EDE13DB59FBC370572CA72D66E36C
                                                                                                                                                                                                                          SHA1:A0BE976BB2269ECB935661972C427CDD70BDCA1E
                                                                                                                                                                                                                          SHA-256:1E5902164A0AE536D9E4430B6CB29884B718FC4DF5901583F13A96D848266AD4
                                                                                                                                                                                                                          SHA-512:153439FE69A27A5FCEA82162B42FEA5BD88A469B1A853E5FC9DFBF8B6F64CD90B3900DC5683593F1DC97553DAEF4D42857E9437CC4BF05E95C3117619B4BCEB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:https://files.pythonhosted.org/packages/source/c/certifi/certifi-2016.9.26.tar.gz#md5=baa81e951a29958563689d868ef1064d.https://files.pythonhosted.org/packages/source/w/wincertstore/wincertstore-0.2.zip#md5=ae728f2f007185648d0c7a8679b361e2.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3143
                                                                                                                                                                                                                          Entropy (8bit):4.536591833837899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:R/YG8BZvy3g6yj+DsmnA540rZh2Phv4hhpTSeTonTj:qG8jPAorZoP94hTTSecTj
                                                                                                                                                                                                                          MD5:B7EFFC5DA69B35D6794BA145EC0FE238
                                                                                                                                                                                                                          SHA1:BCB0BA6F1E37C84D8616760EA8B555F6DE37CB5B
                                                                                                                                                                                                                          SHA-256:D4AE45AF4FB93E1DD945916EC0D6B0F0444688D2D5A87BDD28336DDE85C64BAC
                                                                                                                                                                                                                          SHA-512:8DF58FF4BD178241EBFFF00A6135FF1701D85D0FACC18B747E763B9BBE0CCCD2E6D19F067866B2D802693B53DCF9BE9935481E179886D264750FA6693A7C7C66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:[console_scripts].easy_install = setuptools.command.easy_install:main.easy_install-3.8 = setuptools.command.easy_install:main..[distutils.commands].alias = setuptools.command.alias:alias.bdist_egg = setuptools.command.bdist_egg:bdist_egg.bdist_rpm = setuptools.command.bdist_rpm:bdist_rpm.bdist_wininst = setuptools.command.bdist_wininst:bdist_wininst.build_clib = setuptools.command.build_clib:build_clib.build_ext = setuptools.command.build_ext:build_ext.build_py = setuptools.command.build_py:build_py.develop = setuptools.command.develop:develop.dist_info = setuptools.command.dist_info:dist_info.easy_install = setuptools.command.easy_install:easy_install.egg_info = setuptools.command.egg_info:egg_info.install = setuptools.command.install:install.install_egg_info = setuptools.command.install_egg_info:install_egg_info.install_lib = setuptools.command.install_lib:install_lib.install_scripts = setuptools.command.install_scripts:install_scripts.rotate = setuptools.command.rotate:rotate.saveop
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):38
                                                                                                                                                                                                                          Entropy (8bit):3.8655768552072494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:hW4LWghk5QfQYv:xWgPv
                                                                                                                                                                                                                          MD5:C911255B0C11098C6AB7EDF664FDC8B3
                                                                                                                                                                                                                          SHA1:C3D3C7436574C24EC30386B6DA3807B01731B671
                                                                                                                                                                                                                          SHA-256:D87517555C00E0F7DFD7181316BDC6B135D729A3DA3BABE51BAA0D27FE2EE138
                                                                                                                                                                                                                          SHA-512:FEA204772A9F16D91B40A602F0ECA01C75AAC061A7456D94D2E7F6D55F318F2E2FFBB3ABD81D066824E2416E4671AD2A9BADBDB0280C1C9CCEED014B1E05DB30
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:easy_install.pkg_resources.setuptools.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:very short file (no magic)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1
                                                                                                                                                                                                                          Entropy (8bit):0.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:v:v
                                                                                                                                                                                                                          MD5:68B329DA9893E34099C7D8AD5CB9C940
                                                                                                                                                                                                                          SHA1:ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
                                                                                                                                                                                                                          SHA-256:01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
                                                                                                                                                                                                                          SHA-512:BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1507344
                                                                                                                                                                                                                          Entropy (8bit):6.5709361022194255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:QQlwZAfmGjqTQnT40vCi9QFPzT4JGYAxfxF7P1AkXq3AC36vAPdKiyrG:QAeA+GjYQnT40gFPMGYKr72gqwAj9
                                                                                                                                                                                                                          MD5:AE6C9D9F085262B4623791BABB088E3F
                                                                                                                                                                                                                          SHA1:D908CBFD291A72F355A2080F6670EB7C661FDE08
                                                                                                                                                                                                                          SHA-256:2934DBA913CAF3CEA148207D8C4506350A02F0D4E150BBA229113EBE8FE3BC6B
                                                                                                                                                                                                                          SHA-512:1438ADBB5925F5DA07EEF6E50F40AC8C56E46B8C69E926C3CBA183FC2316344AE6AFA0897D1000492804B5809808EB17A74CCB0BF5ACEF0FE0575F861A594B89
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i..l-.?-.?-.?$.>?!.?..>/.?..>!.?..>%.?..>).?v..>..?-.?\.?...>,.?...>,.?..R?,.?...>,.?Rich-.?........PE..d....={_.........." ......................................................... ............`.........................................p.... ..D...................H...................p=..T............................=..0............................................text...x........................... ..`.rdata..............................@..@.data...p5.......,..................@....pdata..H...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1705120
                                                                                                                                                                                                                          Entropy (8bit):6.496511987047776
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:umJTd0nVi/Md3bupZkKBhWPRIlq5YZ6a2CXH7oZgKGc+erWJUVWyubuapwQDlaTR:umJTd4iMwXH7oZgKb++BVL4B+GITgr0h
                                                                                                                                                                                                                          MD5:C0B23815701DBAE2A359CB8ADB9AE730
                                                                                                                                                                                                                          SHA1:5BE6736B645ED12E97B9462B77E5A43482673D90
                                                                                                                                                                                                                          SHA-256:F650D6BC321BCDA3FC3AC3DEC3AC4E473FB0B7B68B6C948581BCFC54653E6768
                                                                                                                                                                                                                          SHA-512:ED60384E95BE8EA5930994DB8527168F78573F8A277F8D21C089F0018CD3B9906DA764ED6FCC1BD4EFAD009557645E206FBB4E5BAEF9AB4B2E3C8BB5C3B5D725
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k)...GD..GD..GD.bFE..GD9..D..GD.bDE..GD.bBE..GD.bCE..GD.r.D..GD.jAE..GD.jFE..GD..FD..GD.bOE..GD.bGE..GD.b.D..GD.bEE..GDRich..GD........PE..d......\.........." .....d..........0h.......................................@.......b....`..........................................p..._......T.......0.... ............... .......<...............................=...............................................text....b.......d.................. ..`.rdata...k.......l...h..............@..@.data...."..........................@....pdata....... ......................@..@.rsrc...0...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10012
                                                                                                                                                                                                                          Entropy (8bit):4.988870027581882
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:oM9irmCuZgxr31nvnaLAlgspxUth+PNkuQmYz6mh8029d2rPYVzXWamv:oM9irmCuixrxvispxUth+IzX29grPKzu
                                                                                                                                                                                                                          MD5:AAD7CE4027C713577DF2BC8D35406C13
                                                                                                                                                                                                                          SHA1:931262903B347F18AC1BE338524DB851B7AAE5BB
                                                                                                                                                                                                                          SHA-256:D4B3D9601454EA4828DFF3BE426C33FB845D005E98D2CC139DBB0D69CAD3168B
                                                                                                                                                                                                                          SHA-512:F54362286A3BCC4A421AC1687C6C1986C6575CF7233207D905EBE9217323612663728B8300D5660FC1F5A297BE7D2BFA770F8743C8D115533C3EA8BA5004BC36
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# -*- tcl -*-.# ### ### ### ######### ######### #########.## Overview..# Heuristics to assemble a platform identifier from publicly available.# information. The identifier describes the platform of the currently.# running tcl shell. This is a mixture of the runtime environment and.# of build-time properties of the executable itself..#.# Examples:.# <1> A tcl shell executing on a x86_64 processor, but having a.# wordsize of 4 was compiled for the x86 environment, i.e. 32.# bit, and loaded packages have to match that, and not the.# actual cpu..#.# <2> The hp/solaris 32/64 bit builds of the core cannot be.# distinguished by looking at tcl_platform. As packages have to.# match the 32/64 information we have to look in more places. In.# this case we inspect the executable itself (magic numbers,.# i.e. fileutil::magic::filetype)..#.# The basic information used comes out of the 'os' and 'machine'.# entries of the 'tcl_platform' array. A number of general and.# os/machine specific
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5977
                                                                                                                                                                                                                          Entropy (8bit):4.79231401569641
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:Wo05xaJIrnU0gEMydSv+lrnU0gEMPdSvfSrnUN4y1mP3jm5Q1/I+gYQ1KyHe36mV:Wo05xaJsnU0DMAK+5nU0DMFKfunUN4Oc
                                                                                                                                                                                                                          MD5:2A8B773513480EFA986D9CE061218348
                                                                                                                                                                                                                          SHA1:85763F378A68BA6A1EEE9887CDCF34C14D3AD5BF
                                                                                                                                                                                                                          SHA-256:2F812A0550716B88930174A8CA245698427CD286680C0968558AE269AB52440D
                                                                                                                                                                                                                          SHA-512:D3EC3891CC897A8ABB949EBA6A055D9283BA6E491E1CAEA132D894E7B3FD3B159E8226E0BBCDF369DB3F0E00AA1E0347E5B1838353E75B8AE114A83016010238
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:.# -*- tcl -*-.# ### ### ### ######### ######### #########.## Overview..# Higher-level commands which invoke the functionality of this package.# for an arbitrary tcl shell (tclsh, wish, ...). This is required by a.# repository as while the tcl shell executing packages uses the same.# platform in general as a repository application there can be.# differences in detail (i.e. 32/64 bit builds)...# ### ### ### ######### ######### #########.## Requirements..package require platform.namespace eval ::platform::shell {}..# ### ### ### ######### ######### #########.## Implementation..# -- platform::shell::generic..proc ::platform::shell::generic {shell} {. # Argument is the path to a tcl shell... CHECK $shell. LOCATE base out.. set code {}. # Forget any pre-existing platform package, it might be in. # conflict with this one.. lappend code {package forget platform}. # Inject our platform package. lappend code [list source $base]. # Query and print the architectu
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33935
                                                                                                                                                                                                                          Entropy (8bit):4.898273709861797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:joWBAxonz0L7KILBk0U8Vl9NFljRFpGA1TrPiBDxDFP8sCNl:MWBAxgzY7KIL7j1NFl1Fp11/PiBVBksU
                                                                                                                                                                                                                          MD5:DB52847C625EA3290F81238595A915CD
                                                                                                                                                                                                                          SHA1:45A4ED9B74965E399430290BCDCD64ACA5D29159
                                                                                                                                                                                                                          SHA-256:4FDF70FDCEDEF97AA8BD82A02669B066B5DFE7630C92494A130FC7C627B52B55
                                                                                                                                                                                                                          SHA-512:5A8FB4ADA7B2EFBF1CADD10DBE4DC7EA7ACD101CB8FD0B80DAD42BE3ED8804FC8695C53E6AEEC088C2D4C3EE01AF97D148B836289DA6E4F9EE14432B923C7E40
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# msgcat.tcl --.#.#.This file defines various procedures which implement a.#.message catalog facility for Tcl programs. It should be.#.loaded with the command "package require msgcat"..#.# Copyright (c) 2010-2015 by Harald Oehlmann..# Copyright (c) 1998-2000 by Ajuba Solutions..# Copyright (c) 1998 by Mark Harrison..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...package require Tcl 8.5-.# When the version number changes, be sure to update the pkgIndex.tcl file,.# and the installation directory in the Makefiles..package provide msgcat 1.6.1..namespace eval msgcat {. namespace export mc mcexists mcload mclocale mcmax mcmset mcpreferences mcset\. mcunknown mcflset mcflmset mcloadedlocales mcforgetpackage\.. mcpackageconfig mcpackagelocale.. # Records the list of locales to search. variable Loclist {}.. # List of currently loaded locales. variable LoadedLocales {}.. # Rec
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):101389
                                                                                                                                                                                                                          Entropy (8bit):4.78335748687105
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:r3UFHL/k3tqN0E7NkhtMcrQ3qoyX2/2rCmTMttfN/CrQnXcwIHmlDB/mizvB21J1:r3UdOAVfnPIHmlDFmiDB21cK/xasmhC
                                                                                                                                                                                                                          MD5:D34207F736FA9FC26785A4D87C867A44
                                                                                                                                                                                                                          SHA1:24E533DDD16C67E0D0B9ED303A40C9D90ABF3E80
                                                                                                                                                                                                                          SHA-256:3BFD9E06826C98490E22B00200488D06C1FE49E3B78E24E985ABC377B04021FE
                                                                                                                                                                                                                          SHA-512:1007E5812CBF7D907E33FD769FDC4E9A9D0E68852E91208F5C887A2A86849AF69A11CE4B00358059193A46D17F19C26A255A22C107D30433482A8A0CE7ED0D03
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tcltest.tcl --.#.#.This file contains support code for the Tcl test suite. It.# defines the tcltest namespace and finds and defines the output.# directory, constraints available, output and error channels,.#.etc. used by Tcl tests. See the tcltest man page for more.#.details..#.# This design was based on the Tcl testing approach designed and.# initially implemented by Mary Ann May-Pumphrey of Sun.#.Microsystems..#.# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998-1999 by Scriptics Corporation..# Copyright (c) 2000 by Ajuba Solutions.# Contributions from Don Porter, NIST, 2002. (not subject to US copyright).# All rights reserved...package require Tcl 8.5-..;# -verbose line uses [info frame].namespace eval tcltest {.. # When the version number changes, be sure to update the pkgIndex.tcl file,. # and the install directory in the Makefiles. When the minor version. # changes (new feature) be sure to update the man page as well..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):108619
                                                                                                                                                                                                                          Entropy (8bit):4.834993492587442
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:nFRYkDjVePrJwFR09W9JXvfM/2QXjjCV4ScA4MaLm1r:nF2wjVePrJyRpXv9+CV4S74rLg
                                                                                                                                                                                                                          MD5:E9C1DBACE852DE98ECC8906918C3167A
                                                                                                                                                                                                                          SHA1:A3CECEC2C8E67EB0BFCAA6E0DF8970440C29175F
                                                                                                                                                                                                                          SHA-256:D66A3E47106268C4FDE02F857EFDBBC9C44C9BFC6246B7678919F6DAD3C3B68D
                                                                                                                                                                                                                          SHA-512:C830CCA95D8EF2476BFD1B8AA8D0BBD8C557C44989D7398991716DE6F20C075A7FB321ABC0E48A1E5DDF8B4228444678D08761A5FA9D3C417CD58718235F0937
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# http.tcl --.#.#.Client-side HTTP for GET, POST, and HEAD commands. These routines can.#.be used in untrusted code that uses the Safesock security policy..#.These procedures use a callback interface to avoid using vwait, which.#.is not defined in the safe base..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...package require Tcl 8.6-.# Keep this in sync with pkgIndex.tcl and with the install directories in.# Makefiles.package provide http 2.9.0..namespace eval http {. # Allow resourcing to not clobber existing data.. variable http. if {![info exists http]} {..array set http {.. -accept */*.. -pipeline 1.. -postfresh 0.. -proxyhost {}.. -proxyport {}.. -proxyfilter http::ProxyRequired.. -repost 0.. -urlencoding utf-8.. -zip 1..}..# We need a useragent string of this style or various servers will..# refuse to send us compressed content even when we ask for it. This..#
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21148
                                                                                                                                                                                                                          Entropy (8bit):4.7268785966563405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:vyPcB5RJtAZ7SP9nYP9I5HU3mOuWzXBEWKYHEN+7yBtYSbI0QD+lM:AcB5RJtAFSPBYPN3mOuiVHEN+78YSbqT
                                                                                                                                                                                                                          MD5:5E9B3E874F8FBEAADEF3A004A1B291B5
                                                                                                                                                                                                                          SHA1:B356286005EFB4A3A46A1FDD53E4FCDC406569D0
                                                                                                                                                                                                                          SHA-256:F385515658832FEB75EE4DCE5BD53F7F67F2629077B7D049B86A730A49BD0840
                                                                                                                                                                                                                          SHA-512:482C555A0DA2E635FA6838A40377EEF547746B2907F53D77E9FFCE8063C1A24322D8FAA3421FC8D12FDCAFF831B517A65DAFB1CEA6F5EA010BDC18A441B38790
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# auto.tcl --.#.# utility procs formerly in init.tcl dealing with auto execution of commands.# and can be auto loaded themselves..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# auto_reset --.#.# Destroy all cached information for auto-loading and auto-execution, so that.# the information gets recomputed the next time it's needed. Also delete any.# commands that are listed in the auto-load index..#.# Arguments:.# None...proc auto_reset {} {. global auto_execs auto_index auto_path. if {[array exists auto_index]} {..foreach cmdName [array names auto_index] {.. set fqcn [namespace which $cmdName].. if {$fqcn eq ""} {...continue.. }.. rename $fqcn {}..}. }. unset -nocomplain auto_execs auto_index ::tcl::auto_oldpath. if {[catch {llength $auto_path}]} {..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):128934
                                                                                                                                                                                                                          Entropy (8bit):5.001022641779315
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:6klVEuSDFeEzGtdaui+urVke5i1IsQ5SvtTImhrYnPrzAvtt2eyw7uZH/SOyQasa:yDFeEzMaui+urVke5i1R6SvtTImhrYPK
                                                                                                                                                                                                                          MD5:F1E825244CC9741595F47F4979E971A5
                                                                                                                                                                                                                          SHA1:7159DD873C567E10CADAF8638D986FFE11182A27
                                                                                                                                                                                                                          SHA-256:F0CF27CB4B5D9E3B5D7C84B008981C8957A0FF94671A52CC6355131E55DD59FB
                                                                                                                                                                                                                          SHA-512:468C881EB7CE92C91F28CAE2471507A76EF44091C1586DCD716309E3252ED00CCB847EC3296C1954CA6F965161664F7BB73F21A24B9FF5A86F625C0B67C74F67
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#----------------------------------------------------------------------.#.# clock.tcl --.#.#.This file implements the portions of the [clock] ensemble that are.#.coded in Tcl. Refer to the users' manual to see the description of.#.the [clock] command and its subcommands..#.#.#----------------------------------------------------------------------.#.# Copyright (c) 2004,2005,2006,2007 by Kevin B. Kenny.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.#----------------------------------------------------------------------..# We must have message catalogs that support the root locale, and we need.# access to the Registry on Windows systems...uplevel \#0 {. package require msgcat 1.6. if { $::tcl_platform(platform) eq {windows} } {..if { [catch { package require registry 1.1 }] } {.. namespace eval ::tcl::clock [list variable NoRegistry {}]..}. }.}..# Put the library directory into the namespace
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):2.009389929214244
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:5TUvEESVrVJ/eyN9j233V2NdWTeVCT0VbsV7EV7sYnVAMmVZyg851VqxsGkl/:5TUmJvRju3ShVbsZiAMiZyb7PF
                                                                                                                                                                                                                          MD5:68D69C53B4A9F0AABD60646CA7E06DAE
                                                                                                                                                                                                                          SHA1:DD83333DC1C838BEB9102F063971CCC20CC4FD80
                                                                                                                                                                                                                          SHA-256:294C97175FD0894093B866E73548AE660AEED0C3CC1E73867EB66E52D34C0DD2
                                                                                                                                                                                                                          SHA-512:48960E838D30401173EA0DF8597BB5D9BC3A09ED2CFFCB774BA50CB0B2ACCF47AAD3BA2782B3D4A92BEF572CBD98A3F4109FC4344DB82EB207BFDE4F61094D72
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: ascii, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92873
                                                                                                                                                                                                                          Entropy (8bit):3.255311357682213
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:3kkmY4kD7HGJxYXIdjQWTGzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jj9:cGfKqIQCGzv8D7ksb2Ur79jj9
                                                                                                                                                                                                                          MD5:9E67816F304FA1A8E20D2270B3A53364
                                                                                                                                                                                                                          SHA1:9E35EBF3D5380E34B92FE2744124F9324B901DD3
                                                                                                                                                                                                                          SHA-256:465AE2D4880B8006B1476CD60FACF676875438244C1D93A7DBE4CDE1035E745F
                                                                                                                                                                                                                          SHA-512:EE529DA3511EB8D73465EB585561D54833C46B8C31062299B46F5B9EE7EB5BE473E630AA264F45B2806FC1B480C8ED39A173FF1756CB6401B363568E951F0637
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: big5, multi-byte.M.003F 0 89.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.286986942547087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CqTUmJvRju3ShVbsZiAMiZyb7Ptuja5z8twsDO4yT2H:JgmOEVIwAMiw/Ptuja5z8RDtyT2H
                                                                                                                                                                                                                          MD5:79ACD9BD261A252D93C9D8DDC42B8DF6
                                                                                                                                                                                                                          SHA1:FA2271030DB9005D71FAAD60B44767955D5432DD
                                                                                                                                                                                                                          SHA-256:1B42DF7E7D6B0FEB17CB0BC8D97E6CE6899492306DD880C48A39D1A2F0279004
                                                                                                                                                                                                                          SHA-512:607F21A84AE569B19DF42463A56712D232CA192E1827E53F3ACB46D373EF4165A38FFBF116E28D4EAAEF49B08F6162C7A1C517CCE2DFACA71DA07193FEFFFF06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1250, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E2026202020210088203001602039015A0164017D0179.009020182019201C201D202220132014009821220161203A015B0165017E017A.00A002C702D8014100A4010400A600A700A800A9015E00AB00AC00AD00AE017B.00B000B102DB014200B400B500B600B700B80105015F00BB013D02DD013E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D00E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.288070862623515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CTTUmJvRju3ShVbsZiAMiZyb7P4DRrwFsC/+H+SAJlM9aHe3cmx:wgmOEVIwAMiw/PStwFz/T5+smx
                                                                                                                                                                                                                          MD5:55FB20FB09C610DB38C22CF8ADD4F7B8
                                                                                                                                                                                                                          SHA1:604396D81FD2D90F5734FE6C3F283F8F19AABB64
                                                                                                                                                                                                                          SHA-256:2D1BED2422E131A140087FAF1B12B8A46F7DE3B6413BAE8BC395C06F0D70B9B0
                                                                                                                                                                                                                          SHA-512:07C6640BB40407C384BCF646CC436229AEC77C6398D57659B739DC4E180C81A1524F55A5A8F7B3F671A53320052AD888736383486CC01DFC317029079B17172E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1251, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.04020403201A0453201E20262020202120AC203004092039040A040C040B040F.045220182019201C201D202220132014009821220459203A045A045C045B045F.00A0040E045E040800A4049000A600A7040100A9040400AB00AC00AD00AE0407.00B000B104060456049100B500B600B704512116045400BB0458040504550457.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.043004310432043304340435043604370438043
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.2209074629945476
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:C4TUmJvRju3ShVbsZiAMiZyb7PMmVurcNvPNNAkbnMH+tjg:rgmOEVIwAMiw/PMhrUok7zE
                                                                                                                                                                                                                          MD5:5900F51FD8B5FF75E65594EB7DD50533
                                                                                                                                                                                                                          SHA1:2E21300E0BC8A847D0423671B08D3C65761EE172
                                                                                                                                                                                                                          SHA-256:14DF3AE30E81E7620BE6BBB7A9E42083AF1AE04D94CF1203565F8A3C0542ACE0
                                                                                                                                                                                                                          SHA-512:EA0455FF4CD5C0D4AFB5E79B671565C2AEDE2857D534E1371F0C10C299C74CB4AD113D56025F58B8AE9E88E2862F0864A4836FED236F5730360B2223FDE479DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1252, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D017D008F.009020182019201C201D20222013201402DC21220161203A0153009D017E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E800E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.3530146237761445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CRTUmJvRju3ShVbsZiAMiZyb7PMuW24OrKUQQSqJWeIDmq:CgmOEVIwAMiw/PMuW2nKJQSqJWeI1
                                                                                                                                                                                                                          MD5:2E5F553D214B534EBA29A9FCEEC36F76
                                                                                                                                                                                                                          SHA1:8FF9A526A545D293829A679A2ECDD33AA6F9A90E
                                                                                                                                                                                                                          SHA-256:2174D94E1C1D5AD93717B9E8C20569ED95A8AF51B2D3AB2BCE99F1A887049C0E
                                                                                                                                                                                                                          SHA-512:44AB13C0D322171D5EE62946086058CF54963F91EC3F899F3A10D051F9828AC66D7E9F8055026E938DDD1B97A30D5D450B89D72F9113DEE2DBBB62DDBBBE456C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1253, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202100882030008A2039008C008D008E008F.009020182019201C201D20222013201400982122009A203A009C009D009E009F.00A00385038600A300A400A500A600A700A800A9000000AB00AC00AD00AE2015.00B000B100B200B3038400B500B600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B803B
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.2357714075228494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CWTUmJvRju3ShVbsZiAMiZyb7PMSrcmvPNNAkKMH+tZL/M:lgmOEVIwAMiw/PMSrrokKzR0
                                                                                                                                                                                                                          MD5:35AD7A8FC0B80353D1C471F6792D3FD8
                                                                                                                                                                                                                          SHA1:484705A69596C9D813EA361625C3A45C6BB31228
                                                                                                                                                                                                                          SHA-256:BC4CBE4C99FD65ABEA45FBDAF28CC1D5C42119280125FBBD5C2C11892AE460B2
                                                                                                                                                                                                                          SHA-512:CCA3C6A4B826E0D86AC10E45FFC6E5001942AA1CF45B9E0229D56E06F2600DDA0139764F1222C56CF7A9C14E6E6C387F9AB265CB9B936E803FECD8285871C70F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1254, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030016020390152008D008E008F.009020182019201C201D20222013201402DC21220161203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E800E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.267336792625871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CfTUmJvRju3ShVbsZiAMiZyb7PMI22iEePlNQhv6l50b:MgmOEVIwAMiw/PMI27EsQhvgg
                                                                                                                                                                                                                          MD5:0419DBEE405723E7A128A009DA06460D
                                                                                                                                                                                                                          SHA1:660DBE4583923CBDFFF6261B1FADF4349658579C
                                                                                                                                                                                                                          SHA-256:F8BD79AE5A90E5390D77DC31CB3065B0F93CB8813C9E67ACCEC72E2DB2027A08
                                                                                                                                                                                                                          SHA-512:FDD9F23A1B5ABBF973BEE28642A7F28F767557FE842AF0B30B1CF97CD258892F82E547392390A51900DC7FF5D56433549A5CB463779FC131E885B00568F86A32
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1255, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A2039008C008D008E008F.009020182019201C201D20222013201402DC2122009A203A009C009D009E009F.00A000A100A200A320AA00A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE00BF.05B005B105B205B305B405B505B605B705B805B9000005BB05BC05BD05BE05BF.05C005C105C205C305F005F105F205F305F40000000000000000000000000000.05D005D105D205D305D405D505D605D705D805D
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.3332869352420795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:C0TUmJvRju3ShVbsZiAMiZyb7Ps0pPESLym/cwPm+ZMZjyco/fQIG/h:XgmOEVIwAMiw/Ps0FPLym/AsBfg/h
                                                                                                                                                                                                                          MD5:0FFA293AA50AD2795EAB7A063C4CCAE5
                                                                                                                                                                                                                          SHA1:38FEE39F44E14C3A219978F8B6E4DA548152CFD6
                                                                                                                                                                                                                          SHA-256:BBACEA81D4F7A3A7F3C036273A4534D31DBF8B6B5CCA2BCC4C00CB1593CF03D8
                                                                                                                                                                                                                          SHA-512:AB4A6176C8C477463A6CABD603528CEB98EF4A7FB9AA6A8659E1AA6FE3F88529DB9635D41649FBAD779AEB4413F9D8581E6CA078393A3042B468E8CAE0FA0780
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1256, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC067E201A0192201E20262020202102C62030067920390152068606980688.06AF20182019201C201D20222013201406A921220691203A0153200C200D06BA.00A0060C00A200A300A400A500A600A700A800A906BE00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B9061B00BB00BC00BD00BE061F.06C1062106220623062406250626062706280629062A062B062C062D062E062F.063006310632063306340635063600D7063706380639063A0640064106420643.00E0064400E2064506460647064800E700E800E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.2734430397929604
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CNTUmJvRju3ShVbsZiAMiZyb7PtuWTfN641PaxUVG4da:ugmOEVIwAMiw/PtuWkgVfa
                                                                                                                                                                                                                          MD5:A1CCD70248FEA44C0EBB51FB71D45F92
                                                                                                                                                                                                                          SHA1:CC103C53B3BA1764714587EAEBD92CD1BC75194D
                                                                                                                                                                                                                          SHA-256:4151434A714FC82228677C39B07908C4E19952FC058E26E7C3EBAB7724CE0C77
                                                                                                                                                                                                                          SHA-512:74E4A13D65FAB11F205DB1E6D826B06DE421282F7461B273196FD7EECEE123EA0BD32711640B15B482C728966CC0C70FFC67AEDAD91566CA87CD623738E34726
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1257, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0083201E20262020202100882030008A2039008C00A802C700B8.009020182019201C201D20222013201400982122009A203A009C00AF02DB009F.00A0000000A200A300A4000000A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B300B400B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010D00E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.226508038800896
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CKlTUmJvRju3ShVbsZiAMiZyb7PMIX2jmvPNNXkohWiZo//:xgmOEVIwAMiw/PMIXXfkohnun
                                                                                                                                                                                                                          MD5:BB010BFF4DD16B05EEB6E33E5624767A
                                                                                                                                                                                                                          SHA1:6294E42ED22D75679FF1464FF41D43DB3B1824C2
                                                                                                                                                                                                                          SHA-256:0CDB59E255CCD7DCF4AF847C9B020AEAEE78CE7FCF5F214EBCF123328ACF9F24
                                                                                                                                                                                                                          SHA-512:2CD34F75DC61DC1495B0419059783A5579932F43DB9B125CADCB3838A142E0C1CD7B42DB71EF103E268206E31099D6BB0670E84D5658C0E18D0905057FF87182
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp1258, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC0081201A0192201E20262020202102C62030008A20390152008D008E008F.009020182019201C201D20222013201402DC2122009A203A0153009D009E0178.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C2010200C400C500C600C700C800C900CA00CB030000CD00CE00CF.011000D1030900D300D401A000D600D700D800D900DA00DB00DC01AF030300DF.00E000E100E2010300E400E500E600E700E800E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.447501009231115
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CFyTUmJvRju3ShVbsZiAMiZyb7P4jpuKBIrRjK8DvmH:wygmOEVIwAMiw/PYwjKgmH
                                                                                                                                                                                                                          MD5:8645C2DFCC4D5DAD2BCD53A180D83A2F
                                                                                                                                                                                                                          SHA1:3F725245C66050D39D9234BAACE9D047A3842944
                                                                                                                                                                                                                          SHA-256:D707A1F03514806E714F01CBFCB7C9F9973ACDC80C2D67BBD4E6F85223A50952
                                                                                                                                                                                                                          SHA-512:208717D7B1CBDD8A0B8B3BE1B6F85353B5A094BDC370E6B8396158453DD7DC400EE6C4D60490AD1A1F4C943E733298FC971AE30606D6BAB14FB1290B886C76D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp437, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.551534707521956
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CjTUmJvRju3ShVbsZiAMiZyb7P48KhQFhWeYDr1K8DZckbiY:WgmOEVIwAMiw/P9KhQFhWeY31Kk2Y
                                                                                                                                                                                                                          MD5:C68ADEFE02B77F6E6B5217CD83D46406
                                                                                                                                                                                                                          SHA1:C95EA4ED3FBEF013D810C0BFB193B15FA8ADE7B8
                                                                                                                                                                                                                          SHA-256:8BFCA34869B3F9A3B2FC71B02CBAC41512AF6D1F8AB17D2564E65320F88EDE10
                                                                                                                                                                                                                          SHA-512:5CCAACD8A9795D4FE0FD2AC6D3E33C10B0BCC43B29B45DFBA66FBD180163251890BB67B8185D806E4341EB01CB1CED6EA682077577CC9ED948FC094B099A662A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp737, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.039103920393039403950396039703980399039A039B039C039D039E039F03A0.03A103A303A403A503A603A703A803A903B103B203B303B403B503B603B703B8.03B903BA03BB03BC03BD03BE03BF03C003C103C303C203C403C503C603C703C8.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03C903AC03AD03AE03CA03AF03CC03CD03CB03CE
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.3818286672990854
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CsOTUmJvRju3ShVbsZiAMiZyb7P4DBcqb67JnsUgqIPfJ:AgmOEVIwAMiw/PSzb67NsrLPR
                                                                                                                                                                                                                          MD5:DE1282E2925870A277AF9DE4C52FA457
                                                                                                                                                                                                                          SHA1:F4301A1340A160E1F282B5F98BF9FACBFA93B119
                                                                                                                                                                                                                          SHA-256:44FB04B5C72B584B6283A99B34789690C627B5083C5DF6E8B5B7AB2C68903C06
                                                                                                                                                                                                                          SHA-512:08173FC4E5FC9AA9BD1E296F299036E49C0333A876EA0BDF40BEC9F46120329A530B6AA57B32BC83C7AA5E6BD20DE9F616F4B17532EE54634B6799C31D8F668F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp775, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.010600FC00E9010100E4012300E501070142011301560157012B017900C400C5.00C900E600C6014D00F6012200A2015A015B00D600DC00F800A300D800D700A4.0100012A00F3017B017C017A201D00A600A900AE00AC00BD00BC014100AB00BB.259125922593250225240104010C01180116256325512557255D012E01602510.25142534252C251C2500253C0172016A255A25542569256625602550256C017D.0105010D01190117012F01610173016B017E2518250C25882584258C25902580.00D300DF014C014300F500D500B5014401360137
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.301196372002172
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:C9TUmJvRju3ShVbsZiAMiZyb7P4jpuKBc+mTRF5aefDT4HJ:EgmOEVIwAMiw/PYelF5xfn4p
                                                                                                                                                                                                                          MD5:FF3D96C0954843C7A78299FED6986D9E
                                                                                                                                                                                                                          SHA1:5EAD37788D124D4EE49EC4B8AA1CF6AAA9C2849C
                                                                                                                                                                                                                          SHA-256:55AA2D13B789B3125F5C9D0DC5B6E3A90D79426D3B7825DCD604F56D4C6E36A2
                                                                                                                                                                                                                          SHA-512:B76CD82F3204E17D54FB679615120564C53BBE27CC474101EE073EFA6572B50DB2E9C258B09C0F7EAE8AC445D469461364C81838C07D41B43E353107C06C247E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp850, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D800D70192.00E100ED00F300FA00F100D100AA00BA00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00F000D000CA00CB00C8013100CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B500FE00DE00DA
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.3816687566591797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CPTUmJvRju3ShVbsZiAMiZyb7P4OvEUs5ycHQjc59X/C:mgmOEVIwAMiw/Pkv5ycHQjc59Xa
                                                                                                                                                                                                                          MD5:25A59EA83B8E9F3322A54B138861E274
                                                                                                                                                                                                                          SHA1:904B357C30603DFBCF8A10A054D9399608B131DF
                                                                                                                                                                                                                          SHA-256:5266B6F18C3144CFADBCB7B1D27F0A7EAA1C641FD3B33905E42E4549FD373770
                                                                                                                                                                                                                          SHA-512:F7E41357849599E7BA1D47B9B2E615C3C2EF4D432978251418EBF9314AAEB0E1B0A56ED14ED9BA3BE46D3DABE5DD80E0CA6592AE88FB1923E7C3D90D7F846709
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp852, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E4016F010700E7014200EB0150015100EE017900C40106.00C90139013A00F400F6013D013E015A015B00D600DC01640165014100D7010D.00E100ED00F300FA01040105017D017E0118011900AC017A010C015F00AB00BB.2591259225932502252400C100C2011A015E256325512557255D017B017C2510.25142534252C251C2500253C01020103255A25542569256625602550256C00A4.01110110010E00CB010F014700CD00CE011B2518250C258825840162016E2580.00D300DF00D401430144014801600161015400DA
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.3580450853378596
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CoTUmJvRju3ShVbsZiAMiZyb7P4hHVLjwk6rMZCb32SLauDbr:hgmOEVIwAMiw/PM/wcMb3VuuT
                                                                                                                                                                                                                          MD5:0220F1955F01B676D2595C30DEFB6064
                                                                                                                                                                                                                          SHA1:F8BD4BF6D95F672CB61B8ECAB580A765BEBDAEA5
                                                                                                                                                                                                                          SHA-256:E3F071C63AC43AF66061506EF2C574C35F7BF48553FB5158AE41D9230C1A10DF
                                                                                                                                                                                                                          SHA-512:F7BFF7D6534C9BFDBF0FB0147E31E948F60E933E6DA6A39E8DC62CC55FEBDD6901240460D7B3C0991844CDEE7EB8ED26E5FDBBC12BDC9B8173884D8FCA123B69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp855, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0452040204530403045104010454040404550405045604060457040704580408.04590409045A040A045B040B045C040C045E040E045F040F044E042E044A042A.0430041004310411044604260434041404350415044404240433041300AB00BB.259125922593250225240445042504380418256325512557255D043904192510.25142534252C251C2500253C043A041A255A25542569256625602550256C00A4.043B041B043C041C043D041D043E041E043F2518250C25882584041F044F2580.042F044004200441042104420422044304230436
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.2936796452153128
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CaTUmJvRju3ShVbsZiAMiZyb7P4jpu6u/5WH5aeoC4ljIJ:jgmOEVIwAMiw/Pr/UH5xp4l6
                                                                                                                                                                                                                          MD5:58C52199269A3BB52C3E4C20B5CE6093
                                                                                                                                                                                                                          SHA1:888499D9DFDF75C60C2770386A4500F35753CE70
                                                                                                                                                                                                                          SHA-256:E39985C6A238086B54427475519C9E0285750707DB521D1820E639723C01C36F
                                                                                                                                                                                                                          SHA-512:754667464C4675E8C8F2F88A9211411B3648068085A898D693B33BF3E1FAECC9676805FD2D1A4B19FAAB30E286236DCFB2FC0D498BF9ABD9A5E772B340CEE768
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp857, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE013100C400C5.00C900E600C600F400F600F200FB00F9013000D600DC00F800A300D8015E015F.00E100ED00F300FA00F100D1011E011F00BF00AE00AC00BD00BC00A100AB00BB.2591259225932502252400C100C200C000A9256325512557255D00A200A52510.25142534252C251C2500253C00E300C3255A25542569256625602550256C00A4.00BA00AA00CA00CB00C8000000CD00CE00CF2518250C2588258400A600CC2580.00D300DF00D400D200F500D500B5000000D700DA
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.438607583601603
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CMTUmJvRju3ShVbsZiAMiZyb7P4Aj4AxOt49+nK8DvmH:VgmOEVIwAMiw/PeR+snKgmH
                                                                                                                                                                                                                          MD5:8CA7C4737A18D5326E9A437D5ADC4A1A
                                                                                                                                                                                                                          SHA1:C6B1E9320EEF46FC9A23437C255E4085EA2980DB
                                                                                                                                                                                                                          SHA-256:6DB59139627D29ABD36F38ED2E0DE2A6B234A7D7E681C7DBAF8B888F1CAC49A5
                                                                                                                                                                                                                          SHA-512:2D2427E7A3FF18445321263A42C6DA560E0250691ACBE5113BDE363B36B5E9929003F3C91769A02FF720AB8261429CBFA9D9580C1065FFE77400327B1A5539A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp860, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E300E000C100E700EA00CA00E800CD00D400EC00C300C2.00C900C000C800F400F500F200DA00F900CC00D500DC00A200A300D920A700D3.00E100ED00F300FA00F100D100AA00BA00BF00D200AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.4494568686644276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:ClTUmJvRju3ShVbsZiAMiZyb7P4jpOkPn9R2GRK8DvmH:8gmOEVIwAMiw/PAPXvKgmH
                                                                                                                                                                                                                          MD5:45F0D888DBCB56703E8951C06CFAED51
                                                                                                                                                                                                                          SHA1:53529772EA6322B7949DB73EEBAED91E5A5BA3DA
                                                                                                                                                                                                                          SHA-256:A43A5B58BFC57BD723B12BBDEA9F6E1A921360B36D2D52C420F37299788442D3
                                                                                                                                                                                                                          SHA-512:61D0C361E1C7D67193409EC327568867D1FD0FE448D11F16A08638D3EE31BE95AD37B8A2E67B8FB448D09489AA3F5D65AD9AC18E9BDC690A049F0C015BA806F1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp861, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800D000F000DE00C400C5.00C900E600C600F400F600FE00FB00DD00FD00D600DC00F800A300D820A70192.00E100ED00F300FA00C100CD00D300DA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.4900477558394694
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CdMTUmJvRju3ShVbsZiAMiZyb7P4N6rRjK8DvmH:iMgmOEVIwAMiw/PljKgmH
                                                                                                                                                                                                                          MD5:E417DCE52E8438BBE9AF8AD51A09F9E3
                                                                                                                                                                                                                          SHA1:EF273671D46815F22996EA632D22CC27EB8CA44B
                                                                                                                                                                                                                          SHA-256:AEA716D490C35439621A8F00CA7E4397EF1C70428E206C5036B7AF25F1C3D82F
                                                                                                                                                                                                                          SHA-512:97D65E05008D75BC56E162D51AB76888E1FA0591D9642D7C0D09A5CE823904B5D6C14214828577940EDBE7F0265ABACDD67E4E12FACFDF5C7CD35FA80B90EC02
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp862, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.05D005D105D205D305D405D505D605D705D805D905DA05DB05DC05DD05DE05DF.05E005E105E205E305E405E505E605E705E805E905EA00A200A300A520A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.450081751310228
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CXTUmJvRju3ShVbsZiAMiZyb7P4aGuXVsq5RNK8DvmH:egmOEVIwAMiw/PT3VswKgmH
                                                                                                                                                                                                                          MD5:A2C4062EB4F37C02A45B13BD08EC1120
                                                                                                                                                                                                                          SHA1:7F6ED89BD0D415C64D0B8A037F08A47FEADD14C4
                                                                                                                                                                                                                          SHA-256:13B5CB481E0216A8FC28BFA9D0F6B060CDF5C457B3E12435CA826EB2EF52B068
                                                                                                                                                                                                                          SHA-512:95EFDA8CBC5D52E178640A145859E95A780A8A25D2AF88F98E8FFFA035016CABAE2259D22B3D6A95316F64138B578934FAF4C3403E35C4B7D42E0369B5D88C9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp863, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200C200E000B600E700EA00EB00E800EF00EE201700C000A7.00C900C800CA00F400CB00CF00FB00F900A400D400DC00A200A300D900DB0192.00A600B400F300FA00A800B800B300AF00CE231000AC00BD00BC00BE00AB00BB.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.6558830653506647
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CwTUmJvRju3YhVbsZiAMiZyb7P46SY927iqtcYQjDUjSD:5gmOqVIwAMiw/PCXjcYQfcSD
                                                                                                                                                                                                                          MD5:3C88BF83DBA99F7B682120FBEEC57336
                                                                                                                                                                                                                          SHA1:E0CA400BAE0F66EEBE4DFE147C5A18DD3B00B78C
                                                                                                                                                                                                                          SHA-256:E87EC076F950FCD58189E362E1505DD55B0C8F4FA7DD1A9331C5C111D2CE569F
                                                                                                                                                                                                                          SHA-512:6BD65D0A05F57333DA0078759DB2FC629B56C47DAB24E231DE41AD0DF3D07BF7A2A55D1946A7BA38BE228D415FB2BDB606BF1EF243974ED7DFD204548B2A43BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp864, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00200021002200230024066A0026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00B000B72219221A259225002502253C2524252C251C25342510250C25142518.03B2221E03C600B100BD00BC224800AB00BBFEF7FEF8009B009CFEFBFEFC009F.00A000ADFE8200A300A4FE8400000000FE8EFE8FFE95FE99060CFE9DFEA1FEA5.0660066106620663066406650666066706680669FED1061BFEB1FEB5FEB9061F.00A2FE80FE81FE83FE85FECAFE8BFE8DFE91FE93FE97FE9BFE9FFEA3FEA7FEA9.FEABFEADFEAFFEB3FEB7FEBBFEBFFEC1FEC5FECBFECF00A600AC00F700D7FEC9.0640FED3FED7FEDBFEDFFEE3FEE7FEEBFEEDFEEF
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.451408971174579
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CsKTUmJvRju3ShVbsZiAMiZyb7P4jpuKBn9RUK8DvmH:ggmOEVIwAMiw/PYRXUKgmH
                                                                                                                                                                                                                          MD5:6F290E2C3B8A8EE38642C23674B18C71
                                                                                                                                                                                                                          SHA1:0EB40FEEB8A382530B69748E08BF513124232403
                                                                                                                                                                                                                          SHA-256:407FC0FE06D2A057E9BA0109EA9356CAB38F27756D135EF3B06A85705B616F50
                                                                                                                                                                                                                          SHA-512:A975F69360A28484A8A3B4C93590606B8F372A27EC612ECC2355C9B48E042DCE132E64411CF0B107AA5566CAF6954F6937BEBFE17A2AE79EFF25B67FA0F88B7D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp865, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C700FC00E900E200E400E000E500E700EA00EB00E800EF00EE00EC00C400C5.00C900E600C600F400F600F200FB00F900FF00D600DC00F800A300D820A70192.00E100ED00F300FA00F100D100AA00BA00BF231000AC00BD00BC00A100AB00A4.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.03B100DF039303C003A303C300B503C403A60398
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.435639928335435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CCTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aHe3cIK8D/eke:bgmOEVIwAMiw/Pr5+sIK8ev
                                                                                                                                                                                                                          MD5:C612610A7B63519BB7FEFEE26904DBB5
                                                                                                                                                                                                                          SHA1:431270939D3E479BF9B9A663D9E67FCEBA79416F
                                                                                                                                                                                                                          SHA-256:82633643CD326543915ACC5D28A634B5795274CD39974D3955E51D7330BA9338
                                                                                                                                                                                                                          SHA-512:A3B84402AB66B1332C150E9B931E75B401378DDB4378D993DD460C81909DB72F2D136F0BE7B014F0A907D9EF9BE541C8E0B42CAB01667C6EF17E1DE1E0A3D0AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp866, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.259125922593250225242561256225562555256325512557255D255C255B2510.25142534252C251C2500253C255E255F255A25542569256625602550256C2567.2568256425652559255825522553256B256A2518250C25882584258C25902580.0440044104420443044404450446044704480449
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.458262128093304
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CtTUmJvRju3ShVbsZiAMiZyb7P4UN+lhNo5+8dKfQFhWGDrjz9:EgmOEVIwAMiw/PxYNo5+8dKfQFhWG3jZ
                                                                                                                                                                                                                          MD5:51B18570775BCA6465BD338012C9099C
                                                                                                                                                                                                                          SHA1:E8149F333B1809DCCDE51CF8B6332103DDE7FC30
                                                                                                                                                                                                                          SHA-256:27F16E3DD02B2212C4980EA09BDC068CF01584A1B8BB91456C03FCABABE0931E
                                                                                                                                                                                                                          SHA-512:EB285F0E5A9333FFF0E3A6E9C7CAC9D44956EDF180A46D623989A93683BC70EE362256B58EB9AED3BFC6B5C8F5DB4E42540DFC681D51D22A97398CD18F76A1E1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp869, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850386008700B700AC00A620182019038820150389.038A03AA038C00930094038E03AB00A9038F00B200B303AC00A303AD03AE03AF.03CA039003CC03CD039103920393039403950396039700BD0398039900AB00BB.25912592259325022524039A039B039C039D256325512557255D039E039F2510.25142534252C251C2500253C03A003A1255A25542569256625602550256C03A3.03A403A503A603A703A803A903B103B203B32518250C2588258403B403B52580.03B603B703B803B903BA03BB03BC03BD03BE03BF
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1090
                                                                                                                                                                                                                          Entropy (8bit):3.2660589395582478
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:CSyTUmJvRju3ShVbsZiAMiZyb7PQXzHmED43U/TW5dV:CgmOEVIwAMiw/PIr43UKV
                                                                                                                                                                                                                          MD5:7884C95618EF4E9BAA1DED2707F48467
                                                                                                                                                                                                                          SHA1:DA057E1F93F75521A51CC725D47130F41E509E70
                                                                                                                                                                                                                          SHA-256:3E067363FC07662EBE52BA617C2AAD364920F2AF395B3416297400859ACD78BB
                                                                                                                                                                                                                          SHA-512:374AA659A8DB86C023187D02BD7993516CE0EC5B4C6743AD4956AA2DDB86D2B4A57B797253913E08E40485BF3263FBD1C74DDE2C00E6F228201811ED89A6DFF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp874, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC008100820083008420260086008700880089008A008B008C008D008E008F.009020182019201C201D20222013201400980099009A009B009C009D009E009F.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E49
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48207
                                                                                                                                                                                                                          Entropy (8bit):3.450462303370557
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:LhuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtZ7RkEw:LZPV9KuqTxFGXZlQ
                                                                                                                                                                                                                          MD5:AA4398630883066C127AA902832C82E4
                                                                                                                                                                                                                          SHA1:D0B3DEB0EE6539CE5F28A51464BFBB3AA03F28E5
                                                                                                                                                                                                                          SHA-256:9D33DF6E1CFDD2CF2553F5E2758F457D710CAFF5F8C69968F2665ACCD6E9A6FD
                                                                                                                                                                                                                          SHA-512:77794E74B0E6B5855773EE9E1F3B1DA9DB7661D66485DAE6F61CA69F6DA9FD308A55B3A76C9B887135949C60FC3888E6F9A45C6BC481418737AA452A0D9CAE64
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp932, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):132509
                                                                                                                                                                                                                          Entropy (8bit):3.458586416034501
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:JUbXcUPivzybu9VBPbUQMp8nDr+VFQQHkrUkAEAd4WD7tH8dd1+a:muVDQEr2dhDBH8d3+a
                                                                                                                                                                                                                          MD5:27280A39A06496DE6035203A6DAE5365
                                                                                                                                                                                                                          SHA1:3B1D07B02AE7E3B40784871E17F36332834268E6
                                                                                                                                                                                                                          SHA-256:619330192984A80F93AC6F2E4E5EAA463FD3DDDC75C1F65F3975F33E0DD7A0BB
                                                                                                                                                                                                                          SHA-512:EA05CC8F9D6908EE2241E2A72374DAAD55797B5A487394B4C2384847C808AF091F980951941003039745372022DE88807F93EEF6CDB3898FBB300A48A09B66E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp936, multi-byte.M.003F 0 127.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.20AC000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):130423
                                                                                                                                                                                                                          Entropy (8bit):3.0309641114333425
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:1536:fimT/rTarSdgL6MVTCwCWUw62Ljv10xb+KYTuHEh:ftT/IQYLzGxSdCy
                                                                                                                                                                                                                          MD5:6788B104D2297CBD8D010E2776AF6EBA
                                                                                                                                                                                                                          SHA1:904A8B7846D34521634C8C09013DBB1D31AF47CA
                                                                                                                                                                                                                          SHA-256:26BCB620472433962717712D04597A63264C8E444459432565C4C113DE0A240B
                                                                                                                                                                                                                          SHA-512:0DF73561B76159D0A94D16A2DAB22F2B3D88C67146A840CB74D19E70D50A4C7E4DDF1952B5B805471985A896CA9F1B69C3FC4E6D8D17454566D7D39377BA1394
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp949, multi-byte.M.003F 0 125.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):91831
                                                                                                                                                                                                                          Entropy (8bit):3.253346615914323
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:VkkmY4kD7HGJxYXIdjQW7GzvKHBDViIM1sbh+dJE+FKw0sXlWVvDg21jjA:mGfKqIQwGzv8D7ksb2Ur79jjA
                                                                                                                                                                                                                          MD5:A0F8C115D46D02A5CE2B8C56AFF53235
                                                                                                                                                                                                                          SHA1:6605FCCB235A08F9032BB45231B1A6331764664B
                                                                                                                                                                                                                          SHA-256:1FB9A3D52D432EA2D6CD43927CEBF9F58F309A236E1B11D20FE8D5A5FB944E6E
                                                                                                                                                                                                                          SHA-512:124EA2134CF59585DB2C399B13DE67089A6BB5412D2B210DF484FA38B77555AAF0605D04F441BDC2B0BE0F180FA17C145731D7826DA7556A573D357CC00A968F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: cp950, multi-byte.M.003F 0 88.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1093
                                                                                                                                                                                                                          Entropy (8bit):3.7149721845090347
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:vJM0UmJvRjuyfqYCsUBOdXBCbtwHviANskfUPiXFtoE4OSFgHrBPkq:vKfmOEqYCs6CXRPiANIiXFt9XSMdPH
                                                                                                                                                                                                                          MD5:7715CC78774FEA9EB588397D8221FA5B
                                                                                                                                                                                                                          SHA1:6A21D57B44A0856ABCDE61B1C16CB93F4E4C3D74
                                                                                                                                                                                                                          SHA-256:3BDE9AE7EAF9BE799C84B2AA4E80D78BE8ACBACA1E486F10B9BDD42E3AEDDCB2
                                                                                                                                                                                                                          SHA-512:C7500B9DD36F7C92C1A92B8F7BC507F6215B12C26C8CB4564A8A87299859C29C05DEFD3212DE8F2DB76B7DFAB527D6C7B10D1E9A9F6B682F1B5BC4911CFAD26C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: dingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727A82
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1054
                                                                                                                                                                                                                          Entropy (8bit):2.92745681322567
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:scICJZoBqoQzRKCGW5JyY9yZk3Vvd2p4Z4XgiAmV3q:JmqrRKCtEYYZk3V4WSwitV6
                                                                                                                                                                                                                          MD5:67212AAC036FE54C8D4CDCB2D03467A6
                                                                                                                                                                                                                          SHA1:465509C726C49680B02372501AF7A52F09AB7D55
                                                                                                                                                                                                                          SHA-256:17A7D45F3B82F2A42E1D36B13DB5CED077945A3E82700947CD1F803DD2A60DBF
                                                                                                                                                                                                                          SHA-512:9500685760800F5A31A755D582FCEDD8BB5692C27FEEEC2709D982C0B8FCB5238AFB310DCB817F9FE140086A8889B7C60D5D1017764CEB03CB388DD22C8E0B3E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:S.006F 0 1.00.0000000100020003008500090086007F0087008D008E000B000C000D000E000F.0010001100120013008F000A0008009700180019009C009D001C001D001E001F.0080008100820083008400920017001B00880089008A008B008C000500060007.0090009100160093009400950096000400980099009A009B00140015009E001A.002000A000E200E400E000E100E300E500E700F10060002E003C0028002B007C.002600E900EA00EB00E800ED00EE00EF00EC00DF00210024002A0029003B009F.002D002F00C200C400C000C100C300C500C700D1005E002C0025005F003E003F.00F800C900CA00CB00C800CD00CE00CF00CC00A8003A002300400027003D0022.00D800610062006300640065006600670068006900AB00BB00F000FD00FE00B1.00B0006A006B006C006D006E006F00700071007200AA00BA00E600B800C600A4.00B500AF0073007400750076007700780079007A00A100BF00D000DD00DE00AE.00A200A300A500B700A900A700B600BC00BD00BE00AC005B005C005D00B400D7.00F900410042004300440045004600470048004900AD00F400F600F200F300F5.00A6004A004B004C004D004E004F00500051005200B900FB00FC00DB00FA00FF.00D900F70053005400550056005700580059005A00B200D400D600D200D300D5.00300031003
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85574
                                                                                                                                                                                                                          Entropy (8bit):2.3109636068522357
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
                                                                                                                                                                                                                          MD5:9A60E5D1AB841DB3324D584F1B84F619
                                                                                                                                                                                                                          SHA1:BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
                                                                                                                                                                                                                          SHA-256:546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
                                                                                                                                                                                                                          SHA-512:E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):82537
                                                                                                                                                                                                                          Entropy (8bit):2.267779266005065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:c7C2o8+/s5VHxANqsFvGFkMpUEg4MWv947ebZ745zIPcvZ3p6JhE1mrUH2xUoSuL:U+UTHxAlFxkUeGcOmaj6JhEMrUwLf3d1
                                                                                                                                                                                                                          MD5:453626980EB36062E32D98ACECCCBD6E
                                                                                                                                                                                                                          SHA1:F8FCA3985009A2CDD397CB3BAE308AF05B0D7CAC
                                                                                                                                                                                                                          SHA-256:3BFB42C4D36D1763693AEFCE87F6277A11AD5A756D691DEDA804D9D0EDCB3093
                                                                                                                                                                                                                          SHA-512:0F026E1EF3AE1B08BBC7050DB0B181B349511F2A526D2121A6100C426674C0FB1AD6904A5CC11AA924B7F03E33F6971599BAF85C94528428F2E22DCB7D6FE443
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: euc-jp, multi-byte.M.003F 0 79.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D0000008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):93918
                                                                                                                                                                                                                          Entropy (8bit):2.3267174168729032
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:1/W3oNwgt2qyVY1OVxk6ZN4KYDN1uq44hohExh:1/W3pqv10xb+KYTuHEh
                                                                                                                                                                                                                          MD5:93FEADA4D8A974E90E77F6EB8A9F24AB
                                                                                                                                                                                                                          SHA1:89CDA4FE6515C9C03551E4E1972FD478AF3A419C
                                                                                                                                                                                                                          SHA-256:1F1AD4C4079B33B706E948A735A8C3042F40CC68065C48C220D0F56FD048C33B
                                                                                                                                                                                                                          SHA-512:7FC43C273F8C2A34E7AD29375A36B6CAC539AC4C1CDCECFAF0B366DCFE605B5D924D09DAD23B2EE589B1A8A63EE0F7A0CE32CE74AC873369DE8555C9E27A5EDF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: euc-kr, multi-byte.M.003F 0 90.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):86619
                                                                                                                                                                                                                          Entropy (8bit):2.2972446758995697
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:XSeUMIZQkyMiS4Y3fPOYo55XVi684z6WwQrrNoTRoyzDciB126afGG9whRJGAy/I:XhcQjSr3XeXVbmWdWd/zl5auG2hU/I
                                                                                                                                                                                                                          MD5:12DBEEF45546A01E041332427FEC7A51
                                                                                                                                                                                                                          SHA1:5C8E691AE3C13308820F4CF69206D765CFD5094B
                                                                                                                                                                                                                          SHA-256:0C0DF17BFECE897A1DA7765C822453B09866573028CECCED13E2EFEE02BCCCC4
                                                                                                                                                                                                                          SHA-512:FC8A250EE17D5E94A765AFCD9464ECAE74A4E2FF594A8632CEAEC5C84A3C4D26599642DA42E507B7873C37849D3E784CFB0792DE5B4B4262428619D7473FF611
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: gb12345, double-byte.D.233F 0 83.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.1978221748141253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:qrmTUmJvRju36hVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:qSgmO8VIwAMiw/PNPQPFj
                                                                                                                                                                                                                          MD5:06645FE6C135D2EDE313629D24782F98
                                                                                                                                                                                                                          SHA1:49C663AC26C1FE4F0FD1428C9EF27058AEE6CA95
                                                                                                                                                                                                                          SHA-256:A2717AE09E0CF2D566C245DC5C5889D326661B40DB0D5D9A6D95B8E6B0F0E753
                                                                                                                                                                                                                          SHA-512:DB544CFE58753B2CF8A5D65321A2B41155FE2430DB6783DD2F20E1244657482072633D16C8AC99765C113B60E99C8718263C483763A34C5E4BB04B4FFBA41976
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: gb1988, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.002000210022002300A500250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):84532
                                                                                                                                                                                                                          Entropy (8bit):2.3130049332819502
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:KSevutIzbwixZ1J9vS+MReR8cMvwKVDAcmaj8HEtG0waFtFsKQ2RzIjTfYahm6n3:Kat+wmTJYReltKVMeYkXOjYo5tG3VN+
                                                                                                                                                                                                                          MD5:BF74C90D28E52DD99A01377A96F462E3
                                                                                                                                                                                                                          SHA1:DBA09C670F24D47B95D12D4BB9704391B81DDA9A
                                                                                                                                                                                                                          SHA-256:EC11BFD49C715CD89FB9D387A07CF54261E0F4A1CCEC1A810E02C7B38AD2F285
                                                                                                                                                                                                                          SHA-512:8F5A86BB57256ED2412F6454AF06C52FB44C83EB7B820C642CA9216E9DB31D6EC22965BF5CB9E8AE4492C77C1F48EB2387B1CBDC80F6CDA33FA57C57EC9FF9CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: gb2312, double-byte.D.233F 0 81.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300230FB02C902C700A8300330052015FF5E2225202620182019.201C201D3014301530083009300A300B300C300D300E300F3016301730103011.00B100D700F72236222722282211220F222A222922082237221A22A522252220.23122299222B222E2261224C2248223D221D2260226E226F22642265221E2235.22342642264000B0203220332103FF0400A4FFE0FFE1203000A7211626062605.25CB25CF25CE25C725C625A125A025B325B2203B219221902191219330130000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):85574
                                                                                                                                                                                                                          Entropy (8bit):2.3109636068522357
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:SgOycCs6mBixg1k6y8NMSwR8JMvz6VaVZmASVHBtGtRfS7FXtQ/RSJj9fNLSmXn/:SdC4BmCkjSwAO6VIrahNrVNTSYG3Oln
                                                                                                                                                                                                                          MD5:9A60E5D1AB841DB3324D584F1B84F619
                                                                                                                                                                                                                          SHA1:BCCC899015B688D5C426BC791C2FCDE3A03A3EB5
                                                                                                                                                                                                                          SHA-256:546392237F47D71CEE1DAA1AAE287D94D93216A1FABD648B50F59DDCE7E8AE35
                                                                                                                                                                                                                          SHA-512:E9F42B65A8DFB157D1D3336A94A83D372227BAA10A82EB0C6B6FB5601AA352A576FA3CDFD71EDF74A2285ABCA3B1D3172BB4B393C05B3B4AB141AAF04B10F426
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: euc-cn, multi-byte.M.003F 0 82.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):192
                                                                                                                                                                                                                          Entropy (8bit):4.915818681498601
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SOd5MNXVSVLqRIBXSl1AEXMV/RRDfANDemSjs5dqcRcRZMvs5BCUNZ:SVNFS01K+MtkvSjwqd9NZ
                                                                                                                                                                                                                          MD5:224219C864280FA5FB313ADBC654E37D
                                                                                                                                                                                                                          SHA1:39E20B41CFA8B269377AFA06F9C4D66EDD946ACB
                                                                                                                                                                                                                          SHA-256:E12928E8B5754D49D0D3E799135DE2B480BA84B5DBAA0E350D9846FA67F943EC
                                                                                                                                                                                                                          SHA-512:6E390D83B67E2FD5BCAC1BA603A9C6F8BE071FA64021612CE5F8EE33FD8E3840A8C31A7B00134A0039E46BDC66BEF7EB6EA1F8663BA72816B86AF792EF7BDC56
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso2022-jp, escape-driven.E.name..iso2022-jp.init..{}.final..{}.ascii..\x1b(B.jis0201..\x1b(J.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):115
                                                                                                                                                                                                                          Entropy (8bit):4.945508829557185
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SOd5MNXVTEXIBXSl1AEXNELmUHhqQc6XfUNOvn:SVNFS1K+9Qc6sNA
                                                                                                                                                                                                                          MD5:F6464F7C5E3F642BC3564D59B888C986
                                                                                                                                                                                                                          SHA1:94C5F39256366ABB68CD67E3025F177F54ECD39D
                                                                                                                                                                                                                          SHA-256:6AC0F1845A56A1A537B9A6D9BCB724DDDF3D3A5E61879AE925931B1C0534FBB7
                                                                                                                                                                                                                          SHA-512:B9A7E0A9344D8E883D44D1A975A7C3B966499D34BA6206B15C90250F88A8FA422029CEF190023C4E4BE806791AC3BEA87FD8872B47185B0CE0F9ED9C38C41A84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso2022-kr, escape-driven.E.name..iso2022-kr.init..\x1b$)C.final..{}.iso8859-1.\x0f.ksc5601..\x0e.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226
                                                                                                                                                                                                                          Entropy (8bit):4.925633473589168
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SOd5MNXVUW+IBXSl1AEXM56DfqQc6WHmSjs5dReQSXcRcRZMvs5BCUNxXeR5IHRv:SVNFUX1K+M55Qc6WGSjwRDSXd9NGIHRv
                                                                                                                                                                                                                          MD5:745464FF8692E3C3D8EBBA38D23538C8
                                                                                                                                                                                                                          SHA1:9D6F077598A5A86E6EB6A4EEC14810BF525FBD89
                                                                                                                                                                                                                          SHA-256:753DDA518A7E9F6DC0309721B1FAAE58C9661F545801DA9F04728391F70BE2D0
                                                                                                                                                                                                                          SHA-512:E919677CC96DEF4C75126A173AF6C229428731AB091CDDBB2A6CE4EB82BCD8191CE64A33B418057A15E094A48E846BEE7820619E414E7D90EDA6E2B66923DDA5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso2022, escape-driven.E.name..iso2022.init..{}.final..{}.iso8859-1.\x1b(B.jis0201..\x1b(J.gb1988..\x1b(T.jis0208..\x1b$B.jis0208..\x1b$@.jis0212..\x1b$(D.gb2312..\x1b$A.ksc5601..\x1b$(C.jis0208..\x1b&@\x1b$B.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.163043970763833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:iyTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkbnMH+tjg:iygmOEVIwAMiw/PTvok7zE
                                                                                                                                                                                                                          MD5:E3BAE26F5D3D9A4ADCF5AE7D30F4EC38
                                                                                                                                                                                                                          SHA1:A71B6380EA3D23DC0DE11D3B8CEA86A4C8063D47
                                                                                                                                                                                                                          SHA-256:754EF6BF3A564228AB0B56DDE391521DCC1A6C83CFB95D4B761141E71D2E8E87
                                                                                                                                                                                                                          SHA-512:AFED8F5FE02A9A30987736F08B47F1C19339B5410D6020CC7EA37EA0D717A70AF6CDDC775F53CE261FCF215B579206E56458D61AB4CEB44E060BD6B3AC2F4C41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-1, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E8
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.2483197762497458
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:jTUmJvRju3ShVbsZiAMiZyb7P4UP6L2yhBKyta:jgmOEVIwAMiw/PT6L2Ryta
                                                                                                                                                                                                                          MD5:162E76BD187CB54A5C9F0B72A082C668
                                                                                                                                                                                                                          SHA1:CEC787C4DE78F9DBB97B9C44070CF2C12A2468F7
                                                                                                                                                                                                                          SHA-256:79F6470D9BEBD30832B3A9CA59CD1FDCA28C5BE6373BD01D949EEE1BA51AA7A8
                                                                                                                                                                                                                          SHA-512:ADDBCA6E296286220FFF449D3E34E5267528627AFFF1FCBD2B9AC050A068D116452D70308049D88208FB7CB2C2F7582FCF1703CF22CFC125F2E6FA89B8A653FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-10, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010401120122012A0128013600A7013B011001600166017D00AD016A014A.00B0010501130123012B0129013700B7013C011101610167017E2015016B014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE00CF.00D00145014C00D300D400D500D6016800D8017200DA00DB00DC00DD00DE00DF.010100E100E200E300E400E500E6012F010
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.267798724121087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:olTUmJvRju3ShVbsZiAMiZyb7P4UP1w4LaxUVG4dT:olgmOEVIwAMiw/PT+4VfT
                                                                                                                                                                                                                          MD5:BF3993877A45AC7091CFC81CFD4A4D43
                                                                                                                                                                                                                          SHA1:D462934A074EE13F2C810463FD061084953F77BC
                                                                                                                                                                                                                          SHA-256:33C6072A006BA4E9513D7B7FD3D08B1C745CA1079B6D796C36B2A5AE8E4AE02B
                                                                                                                                                                                                                          SHA-512:17489E6AD6A898628239EA1B43B4BE81ECC33608F0FD3F7F0E19CF74F7FC4752813C3C21F1DC73E9CC8765E23C63ED932799905381431DAF4E10A88EC29EBF6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-13, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0201D00A200A300A4201E00A600A700D800A9015600AB00AC00AD00AE00C6.00B000B100B200B3201C00B500B600B700F800B9015700BB00BC00BD00BE00E6.0104012E0100010600C400C501180112010C00C90179011601220136012A013B.01600143014500D3014C00D500D600D701720141015A016A00DC017B017D00DF.0105012F0101010700E400E501190113010
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.296489289648924
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:vTUmJvRju3ShVbsZiAMiZyb7P4UPt6C5AkE7MH+tZS4Y:vgmOEVIwAMiw/PTAQAkCzsP
                                                                                                                                                                                                                          MD5:3BE4986264587BEC738CC46EBB43D698
                                                                                                                                                                                                                          SHA1:62C253AA7A868CE32589868FAB37336542457A96
                                                                                                                                                                                                                          SHA-256:8D737283289BAF8C08EF1DD7E47A6C775DACE480419C5E2A92D6C0E85BB5B381
                                                                                                                                                                                                                          SHA-512:CB9079265E47EF9672EAACFCE474E4D6771C6F61394F29CC59C9BBE7C99AE89A0EACD73F2BCDD8374C4E03BE9B1685F463F029E35C4070DF9D1B143B02CAD573
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-14, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A01E021E0300A3010A010B1E0A00A71E8000A91E821E0B1EF200AD00AE0178.1E1E1E1F012001211E401E4100B61E561E811E571E831E601EF31E841E851E61.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.017400D100D200D300D400D500D61E6A00D800D900DA00DB00DC00DD017600DF.00E000E100E200E300E400E500E600E700E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.1878838020538374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:mTUmJvRju3ShVbsZiAMiZyb7P4UPvRarkbnMH+tjg:mgmOEVIwAMiw/PTvqk7zE
                                                                                                                                                                                                                          MD5:6AE49F4E916B02EB7EDB160F88B5A27F
                                                                                                                                                                                                                          SHA1:49F7A42889FB8A0D78C80067BDE18094DBE956EE
                                                                                                                                                                                                                          SHA-256:C7B0377F30E42048492E4710FE5A0A54FA9865395B8A6748F7DAC53B901284F9
                                                                                                                                                                                                                          SHA-512:397E636F4B95522FD3909B4546A1B7E31E92388DAE4F9F6B638875449E3498B49320F4C4A47168C7ADD43C78EF5680CAAEE40661DDC8205687532D994133EA3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-15, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A320AC00A5016000A7016100A900AA00AB00AC00AD00AE00AF.00B000B100B200B3017D00B500B600B7017E00B900BA00BB01520153017800BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.00D000D100D200D300D400D500D600D700D800D900DA00DB00DC00DD00DE00DF.00E000E100E200E300E400E500E600E700E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.2349228762697972
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:dTUmJvRju3ShVbsZiAMiZyb7P4UP/SlTPkyTtZVc:dgmOEVIwAMiw/PTqFPkypXc
                                                                                                                                                                                                                          MD5:D30094CAEFA5C4A332159829C6CB7FEC
                                                                                                                                                                                                                          SHA1:50FDA6C70A133CB64CF38AA4B2F313B54D2FD955
                                                                                                                                                                                                                          SHA-256:C40CA014B88F97AE62AE1A816C5963B1ED432A77D84D89C3A764BA15C8A23708
                                                                                                                                                                                                                          SHA-512:6EDD6912053D810D1E2B0698494D26E119EF1BF3FABC2FBFBA44551792800FA0CF163773E4F37F908C2DE41F05D6F17153656623A6D4681BE74EB253D9163422
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-16, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040105014120AC201E016000A7016100A9021800AB017900AD017A017B.00B000B1010C0142017D201D00B600B7017E010D021900BB015201530178017C.00C000C100C2010200C4010600C600C700C800C900CA00CB00CC00CD00CE00CF.0110014300D200D300D4015000D6015A017000D900DA00DB00DC0118021A00DF.00E000E100E2010300E4010700E600E700E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.269412550127009
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:UTUmJvRju3ShVbsZiAMiZyb7P4UPPssm0O4yT2H:UgmOEVIwAMiw/PTPss5tyT2H
                                                                                                                                                                                                                          MD5:69FCA2E8F0FD9B39CDD908348BD2985E
                                                                                                                                                                                                                          SHA1:FF62EB5710FDE11074A87DAEE9229BCF7F66D7A0
                                                                                                                                                                                                                          SHA-256:0E0732480338A229CC3AD4CDDE09021A0A81902DC6EDFB5F12203E2AFF44668F
                                                                                                                                                                                                                          SHA-512:46A7899D17810D2E0FF812078D91F29BF2BB8770F09A02367CF8361229F424FC9B06EAC8E3756491612972917463B6F27DB3D897AFAE8DB5F159D45975D9CBD8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-2, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0010402D8014100A4013D015A00A700A80160015E0164017900AD017D017B.00B0010502DB014200B4013E015B02C700B80161015F0165017A02DD017E017C.015400C100C2010200C40139010600C7010C00C9011800CB011A00CD00CE010E.01100143014700D300D4015000D600D70158016E00DA017000DC00DD016200DF.015500E100E2010300E4013A010700E7010D
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.178020305301999
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:tTUmJvRju3ShVbsZiAMiZyb7P4UPp2g4kBTvSMkFtP0:tgmOEVIwAMiw/PTj4kBTvSDP0
                                                                                                                                                                                                                          MD5:5685992A24D85E93BD8EA62755E327BA
                                                                                                                                                                                                                          SHA1:B0BEBEDEC53FFB894D9FB0D57F25AB2A459B6DD5
                                                                                                                                                                                                                          SHA-256:73342C27CF55F625D3DB90C5FC8E7340FFDF85A51872DBFB1D0A8CB1E43EC5DA
                                                                                                                                                                                                                          SHA-512:E88ED02435026CA9B8A23073F61031F3A75C4B2CD8D2FC2B598F924ADF34B268AB16909120F1D96B794BDBC484C764FDE83B63C9FB122279AC5242D57030AF3A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-3, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0012602D800A300A40000012400A700A80130015E011E013400AD0000017B.00B0012700B200B300B400B5012500B700B80131015F011F013500BD0000017C.00C000C100C2000000C4010A010800C700C800C900CA00CB00CC00CD00CE00CF.000000D100D200D300D4012000D600D7011C00D900DA00DB00DC016C015C00DF.00E000E100E2000000E4010B010900E700E8
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.2703067063488724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:KTUmJvRju3ShVbsZiAMiZyb7P4UP04xsD/njwKyjhJ:KgmOEVIwAMiw/PT06s3fylJ
                                                                                                                                                                                                                          MD5:07576E85AFDB2816BBCFFF80E2A12747
                                                                                                                                                                                                                          SHA1:CC1C2E6C35B005C17EB7B1A3D744983A86A75736
                                                                                                                                                                                                                          SHA-256:17745BDD299779E91D41DB0CEE26CDC7132DA3666907A94210B591CED5A55ADB
                                                                                                                                                                                                                          SHA-512:309EEF25EE991E3321A57D2CEE139C9C3E7C8B3D9408664AAFE9BA34E28EF5FB8167481F3C5CAD0557AE55249E47016CA3A6AC19857D76EFB58D0CDAC428F600
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-4, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A001040138015600A40128013B00A700A8016001120122016600AD017D00AF.00B0010502DB015700B40129013C02C700B80161011301230167014A017E014B.010000C100C200C300C400C500C6012E010C00C9011800CB011600CD00CE012A.01100145014C013600D400D500D600D700D8017200DA00DB00DC0168016A00DF.010100E100E200E300E400E500E6012F010D
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.2716690950473573
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:zTUmJvRju3ShVbsZiAMiZyb7P4UPNXe+SAJlM9aHe3cmy+:zgmOEVIwAMiw/PTNp5+smy+
                                                                                                                                                                                                                          MD5:67577E6720013EEF73923D3F050FBFA1
                                                                                                                                                                                                                          SHA1:F9F64BB6014068E2C0737186C694B8101DD9575E
                                                                                                                                                                                                                          SHA-256:BC5ED164D15321404BBDCAD0D647C322FFAB1659462182DBD3945439D9ECBAE7
                                                                                                                                                                                                                          SHA-512:B584DB1BD5BE97CCFCA2F71E765DEC66CF2ABE18356C911894C988B2238E14074748C71074E0633C7CA50733E189D937160A35438C720DB2243CBC3566F52629
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-5, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0040104020403040404050406040704080409040A040B040C00AD040E040F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.0430043104320433043404350436043704380439043A043B043C043D043E043F.044004410442044304440445044604470448
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):2.9147595181616284
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:YTUmJvRju3ShVbsZiAMiZyb7P4UPSIZjyco/rs:YgmOEVIwAMiw/PTBsBrs
                                                                                                                                                                                                                          MD5:49DEC951C7A7041314DF23FE26C9B300
                                                                                                                                                                                                                          SHA1:B810426354D857718CC841D424DA070EFB9F144F
                                                                                                                                                                                                                          SHA-256:F502E07AE3F19CCDC31E434049CFC733DD5DF85487C0160B0331E40241AD0274
                                                                                                                                                                                                                          SHA-512:CB5D8C5E807A72F35AD4E7DA80882F348D70052169A7ED5BB585152C2BF628177A2138BD0A982A398A8DF373E1D3E145AD1F6C52485DE57ECBE5A7ED33E13776
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-6, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000000000000000A40000000000000000000000000000060C00AD00000000.00000000000000000000000000000000000000000000061B000000000000061F.0000062106220623062406250626062706280629062A062B062C062D062E062F.0630063106320633063406350636063706380639063A00000000000000000000.064006410642064306440645064606470648
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.2933089629252037
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:TMyTUmJvRju3ShVbsZiAMiZyb7P4UP1mKUQQSqJWeIDmq:TlgmOEVIwAMiw/PTkKJQSqJWeI1
                                                                                                                                                                                                                          MD5:0AF65F8F07F623FA38E2D732400D95CF
                                                                                                                                                                                                                          SHA1:D2903B32FEA225F3FB9239E622390A078C8A8FA6
                                                                                                                                                                                                                          SHA-256:8FEC7631A69FCF018569EBADB05771D892678790A08E63C05E0007C9910D58A8
                                                                                                                                                                                                                          SHA-512:EF03237A030C54E0E20DBA7ED724580C513490B9B3B043C1E885638E7BCE21415CE56C3902EA39689365B12E44194C6BF868C4D9BCBCA8FDC334BE77DA46E24D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-7, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A02018201900A30000000000A600A700A800A9000000AB00AC00AD00002015.00B000B100B200B303840385038600B703880389038A00BB038C00BD038E038F.0390039103920393039403950396039703980399039A039B039C039D039E039F.03A003A1000003A303A403A503A603A703A803A903AA03AB03AC03AD03AE03AF.03B003B103B203B303B403B503B603B703B8
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):2.9730608214144323
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:uTUmJvRju3ShVbsZiAMiZyb7P4UPtePly0b:ugmOEVIwAMiw/PTtw
                                                                                                                                                                                                                          MD5:45E35EFF7ED2B2DF0B5694A2B639FE1E
                                                                                                                                                                                                                          SHA1:4EA5EC5331541EDE65A9CF601F5418FD4B6CFCBC
                                                                                                                                                                                                                          SHA-256:E1D207917AA3483D9110E24A0CC0CD1E0E5843C8BFC901CFEE7A6D872DD945A9
                                                                                                                                                                                                                          SHA-512:527283C9EFF2C1B21FAE716F5DFB938D8294B22938C76A73D88135312FA01B5C3DF288461CCE8B692928B334A28A7D29319F9F48733174C898F41BD1BEB8E862
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-8, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A0000000A200A300A400A500A600A700A800A900D700AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900F700BB00BC00BD00BE0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000002017.05D005D105D205D305D405D505D605D705D8
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1094
                                                                                                                                                                                                                          Entropy (8bit):3.1865263857127375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:XTUmJvRju3ShVbsZiAMiZyb7P4UPvvPNNAkKMH+tZL/M:XgmOEVIwAMiw/PTvokKzR0
                                                                                                                                                                                                                          MD5:675C89ECD212C8524B1875095D78A5AF
                                                                                                                                                                                                                          SHA1:F585C70A5589DE39558DAC016743FF85E0C5F032
                                                                                                                                                                                                                          SHA-256:1CDCF510C38464E5284EDCFAEC334E3FC516236C1CA3B9AB91CA878C23866914
                                                                                                                                                                                                                          SHA-512:E620657C5F521A101B6FF7B5FD9A7F0DDD560166BA109D20E91F2E828F81697F897DFA136533C0D6F24A9861E92F34C0CC0FA590F344713C089157F8AC3ECFE2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: iso8859-9, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.00A000A100A200A300A400A500A600A700A800A900AA00AB00AC00AD00AE00AF.00B000B100B200B300B400B500B600B700B800B900BA00BB00BC00BD00BE00BF.00C000C100C200C300C400C500C600C700C800C900CA00CB00CC00CD00CE00CF.011E00D100D200D300D400D500D600D700D800D900DA00DB00DC0130015E00DF.00E000E100E200E300E400E500E600E700E8
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1092
                                                                                                                                                                                                                          Entropy (8bit):3.1984111069807395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:zBTUmJvRju3ShVbsZiAMiZyb7PN8pUPnfk5JM0RHFj:zBgmOEVIwAMiw/PNPQPFj
                                                                                                                                                                                                                          MD5:0DCB64ACBB4B518CC20F4E196E04692C
                                                                                                                                                                                                                          SHA1:7AEB708C89C178FB4D5611C245EA1A7CF66ADF3A
                                                                                                                                                                                                                          SHA-256:480F61D0E1A75DEE59BF9A66DE0BB78FAAE4E87FD6317F93480412123277D442
                                                                                                                                                                                                                          SHA-512:4AFA210763DE9742626886D7D281AC15169CDC7A31D185F48D105190CA247AA014FB8F281AFCB4A0C31D2D55EE7D907B6A8E51FC4BEEDB9DB8C484E88CAA78A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: jis0201, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D203E007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.00000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):80453
                                                                                                                                                                                                                          Entropy (8bit):2.274731552146978
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:R7Cyeug/RAEo7umlshyGYknyRXglMVw9bq7bYI45zh2cvA3FXwhZ1BrUc2C5oS5u:RgZJo7uNhbyO1ZiEXPcXwhZbrUPkBso2
                                                                                                                                                                                                                          MD5:F35938AC582E460A14646D2C93F1A725
                                                                                                                                                                                                                          SHA1:A922ACACE0C1A4A7DDC92FE5DD7A116D30A3686B
                                                                                                                                                                                                                          SHA-256:118EA160EF29E11B46DEC57AF2C44405934DD8A7C49D2BC8B90C94E8BAA6138B
                                                                                                                                                                                                                          SHA-512:D27CD9C9D67370C288036AACA5999314231F7070152FF7EEF1F3379E748EF9047001430D391B61C281FF69AB4F709D47F8FF5390873B5DEFD105371AB8FB8872
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: jis0208, double-byte.D.2129 0 77.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000300030013002FF0CFF0E30FBFF1AFF1BFF1FFF01309B309C00B4FF4000A8.FF3EFFE3FF3F30FD30FE309D309E30034EDD30053006300730FC20152010FF0F.FF3C301C2016FF5C2026202520182019201C201DFF08FF0930143015FF3BFF3D.FF5BFF5D30083009300A300B300C300D300E300F30103011FF0B221200B100D7.00F7FF1D2260FF1CFF1E22662267221E22342642264000B0203220332103FFE5.FF0400A200A3FF05FF03FF06FF0AFF2000A72606260525CB25CF25CE25C70000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):70974
                                                                                                                                                                                                                          Entropy (8bit):2.2631380488363284
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:WmU4+qNPpEzjKgGWJACVeCssX2Qt5E2+G7PBIv:LU4+qNaCgGW7VGK2o+0qv
                                                                                                                                                                                                                          MD5:F518436AC485F5DC723518D7872038E0
                                                                                                                                                                                                                          SHA1:15013478760463A0BCE3577B4D646ECDB07632B5
                                                                                                                                                                                                                          SHA-256:24A9D379FDA39F2BCC0580CA3E0BD2E99AE279AF5E2841C9E7DBE7F931D19CC0
                                                                                                                                                                                                                          SHA-512:2325705D4772A10CD81082A035BEAC85E6C64C7CCFA5981955F0B85CAF9A95D8A0820092957822A05C2E8E773F2089035ED5E76BF3FAF19B0E7E6AED7B4214D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: jis0212, double-byte.D.2244 0 68.22.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000000000000000000000000000000000000000000000000000000000002D8.02C700B802D902DD00AF02DB02DA007E03840385000000000000000000000000.0000000000A100A600BF00000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000BA00AA00A900AE2122.00A4211600000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.463428231669408
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:KcJ5mTUmJvRju3ShVbsZiAMiZyb7PcSzm1XvRS3YcmchJQ3MAxSy:KmmgmOEVIwAMiw/Ptz8gBmRcAx5
                                                                                                                                                                                                                          MD5:E66D42CB71669CA0FFBCDC75F6292832
                                                                                                                                                                                                                          SHA1:366C137C02E069B1A93FBB5D64B9120EA6E9AD1F
                                                                                                                                                                                                                          SHA-256:7142B1120B993D6091197574090FE04BE3EA64FFC3AD5A167A4B5E0B42C9F062
                                                                                                                                                                                                                          SHA-512:6FBF7AF0302B4AA7EF925EFED7235E946EDA8B628AA204A8BBB0A3D1CB8C79DD37D9DD92A276AD14B55776FEBB3B55CF5881AC4013F95ED4E618E3B49771E8A5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: koi8-r, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204512553255425552556255725582559255A255B255C255D255E.255F25602561040125622563256425652566256725682569256A256B256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.439504497428066
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:K+TUmJvRju3ShVbsZiAMiZyb7PcSzmn3gXDRS3YcmchJQ3MAxSy:K+gmOEVIwAMiw/Ptz0KgBmRcAx5
                                                                                                                                                                                                                          MD5:D722EFEA128BE671A8FDA45ED7ADC586
                                                                                                                                                                                                                          SHA1:DA9E67F64EC4F6A74C60CB650D5A12C4430DCFF7
                                                                                                                                                                                                                          SHA-256:BBB729B906F5FC3B7EE6694B208B206D19A9D4DC571E235B9C94DCDD4A323A2A
                                                                                                                                                                                                                          SHA-512:FDF183C1A0D9109E21F7EEBC5996318AEDED3F87319A980C4E96BFE1D43593BDB693D181744C5C7E391A849783E3594234060A9F76116DE56F9592EF95979E63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: koi8-u, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.25002502250C251025142518251C2524252C2534253C258025842588258C2590.259125922593232025A02219221A22482264226500A0232100B000B200B700F7.25502551255204510454255404560457255725582559255A255B0491255D255E.255F25602561040104032563040604072566256725682569256A0490256C00A9.044E0430043104460434043504440433044504380439043A043B043C043D043E.043F044F044004410442044304360432044C044B04370448044D04490447044A.042E04100411042604140415042404130425041
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):92877
                                                                                                                                                                                                                          Entropy (8bit):2.32911747373862
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:XtWS2ymX62EztZ1Oyxk1uGtQPUNg0q+6XVfEFh:XtWnzEn1HxRQQPV0Eeh
                                                                                                                                                                                                                          MD5:599CEA614F5C5D01CDFA433B184AA904
                                                                                                                                                                                                                          SHA1:C2FFA427457B4931E5A92326F251CD3D671059B0
                                                                                                                                                                                                                          SHA-256:0F8B530AD0DECBF8DD81DA8291B8B0F976C643B5A292DB84680B31ECFBE5D00A
                                                                                                                                                                                                                          SHA-512:43D24B719843A21E3E1EDDFC3607B1B198542306C2EC8D621188CD39BA913D23678D39D12D8370CC1CE12828661AF0A5F14AD2B2BF99F62387C5E3E365BA1E75
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: ksc5601, double-byte.D.233F 0 89.21.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.000030003001300200B72025202600A8300300AD20152225FF3C223C20182019.201C201D3014301530083009300A300B300C300D300E300F3010301100B100D7.00F7226022642265221E223400B0203220332103212BFFE0FFE1FFE526422640.222022A52312220222072261225200A7203B2606260525CB25CF25CE25C725C6.25A125A025B325B225BD25BC219221902191219321943013226A226B221A223D.221D2235222B222C2208220B2286228722822283222A222922272228FFE20000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1096
                                                                                                                                                                                                                          Entropy (8bit):3.3601842107710365
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8jTUmJvRju3ShVbsZiAMiZyb7P4ZVPJS82WcVDX1MPEd4RPMppJ8K:8jgmOEVIwAMiw/PsVoy24VMppiK
                                                                                                                                                                                                                          MD5:CADFBF5A4C7CAD984294284D643E9CA3
                                                                                                                                                                                                                          SHA1:16B51D017001688A32CB7B15DE6E7A49F28B76FD
                                                                                                                                                                                                                          SHA-256:8F3089F4B2CA47B7AC4CB78375B2BFAC01268113A7C67D020F8B5B7F2C25BBDA
                                                                                                                                                                                                                          SHA-512:3941ACA62CF59BF6857BA9C300B4236F18690DE1213BB7FCFA0EC87DCD71152849F1DEAFB470CA4BC2ACC2C0C13D7FD57661BFC053960ADD7570DE365AE7E63C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macCentEuro, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C40100010100C9010400D600DC00E10105010C00E4010D0106010700E90179.017A010E00ED010F01120113011600F3011700F400F600F500FA011A011B00FC.202000B0011800A300A7202200B600DF00AE00A92122011900A822600123012E.012F012A22642265012B0136220222110142013B013C013D013E0139013A0145.0146014300AC221A01440147220600AB00BB202600A00148015000D50151014C.20132014201C201D2018201900F725CA014D0154015501582039203A01590156.01570160201A201E0161015A015B00C101
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1096
                                                                                                                                                                                                                          Entropy (8bit):3.3293096097500965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8ULyTUmJvRju3ShVbsZiAMiZyb7P4SNMdNxOZwl+KR8DklJyseQWkv:8ULygmOEVIwAMiw/P34+KR8DklEswm
                                                                                                                                                                                                                          MD5:F13D479550D4967A0BC76A60C89F1461
                                                                                                                                                                                                                          SHA1:63F44E818284384DE07AB0D8B0CD6F7EBFE09AB9
                                                                                                                                                                                                                          SHA-256:8D0B6A882B742C5CCE938241328606C111DDA0CB83334EBEDCDA17605F3641AE
                                                                                                                                                                                                                          SHA-512:80AB9DCAAC1A496FD2CA6BE9959FE2DE201F504D8A58D114F2FF5D1F6AAD507F052B87D29D3EBA69093C3D965CC4C113C9EA6DB8EEBB67BD620ADF860CA2CC35
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macCroatian, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE0160212200B400A82260017D00D8.221E00B122642265220600B522022211220F0161222B00AA00BA03A9017E00F8.00BF00A100AC221A01922248010600AB010C202600A000C000C300D501520153.01102014201C201D2018201900F725CAF8FF00A9204420AC2039203A00C600BB.201300B7201A201E203000C2010700C101
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1096
                                                                                                                                                                                                                          Entropy (8bit):3.3482225358368565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8dTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmh:8dgmOEVIwAMiw/Pr5NY3k9nsmh
                                                                                                                                                                                                                          MD5:60FFC8E390A31157D8646AEAC54E58AE
                                                                                                                                                                                                                          SHA1:3DE17B2A5866272602FB8E9C54930A4CD1F3B06C
                                                                                                                                                                                                                          SHA-256:EB135A89519F2E004282DED21B11C3AF7CCB2320C9772F2DF7D1A4A1B674E491
                                                                                                                                                                                                                          SHA-512:3644429A9BD42ADC356E1BD6FCFABEE120E851348B538A4FE4903B72A533174D7448A6C2DA71219E4CD5D0443C0475417D54C8E113005DF2CA20C608DE5E3306
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macCyrillic, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.0430043104320433043404350436043704
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1096
                                                                                                                                                                                                                          Entropy (8bit):3.8086748658227827
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:87JM0UmJvRjuyfqYCsUBOdXBCbtwHviANskNWkiXFtoE4OSFgHrBPkq:87KfmOEqYCs6CXRPiANHWkiXFt9XSMdf
                                                                                                                                                                                                                          MD5:EBD121A4E93488A48FC0A06ADE9FD158
                                                                                                                                                                                                                          SHA1:A40E6DB97D6DB2893A072B2275DC22E2A4D60737
                                                                                                                                                                                                                          SHA-256:8FBCC63CB289AFAAE15B438752C1746F413F3B79BA5845C2EF52BA1104F8BDA6
                                                                                                                                                                                                                          SHA-512:26879ABE4854908296F32B2BB97AEC1F693C56EC29A7DB9B63B2DA62282F2D2EDAE9D50738595D1530731DF5B1812719A74F50ADF521F80DD5067F3DF6A3517C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macDingbats, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.00202701270227032704260E2706270727082709261B261E270C270D270E270F.2710271127122713271427152716271727182719271A271B271C271D271E271F.2720272127222723272427252726272726052729272A272B272C272D272E272F.2730273127322733273427352736273727382739273A273B273C273D273E273F.2740274127422743274427452746274727482749274A274B25CF274D25A0274F.27502751275225B225BC25C6275625D727582759275A275B275C275D275E007F.F8D7F8D8F8D9F8DAF8DBF8DCF8DDF8DEF8DFF8E0F8E1F8E2F8E3F8E4008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.0000276127622763276427652766276726632666266526602460246124622463.2464246524662467246824692776277727782779277A277B277C277D277E277F.2780278127822783278427852786278727882789278A278B278C278D278E278F.2790279127922793279421922194219527982799279A279B279C279D279E279F.27A027A127A227A327A427A527A627A727
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1093
                                                                                                                                                                                                                          Entropy (8bit):3.4271472017271556
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8dOTUmJvRju3ShVbsZiAMiZyb7P4Hlb7BMM2aSYjsSkUEkp1FsOSUTime:8kgmOEVIwAMiw/Pg7K23s0x1FsOJTime
                                                                                                                                                                                                                          MD5:14AD68855168E3E741FE179888EA7482
                                                                                                                                                                                                                          SHA1:9C2AD53D69F5077853A05F0933330B5D6F88A51C
                                                                                                                                                                                                                          SHA-256:F7BFF98228DED981EC9A4D1D0DA62247A8D23F158926E3ACBEC3CCE379C998C2
                                                                                                                                                                                                                          SHA-512:FB13F32197D3582BC20EEA604A0B0FD7923AE541CCEB3AF1CDE36B0404B8DB6312FB5270B40CBC8BA4C91B9505B57FB357EB875E8AFB3DB76DFB498CE17851ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macGreek, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400B900B200C900B300D600DC038500E000E200E4038400A800E700E900E8.00EA00EB00A3212200EE00EF202200BD203000F400F600A600AD00F900FB00FC.2020039303940398039B039E03A000DF00AE00A903A303AA00A7226000B000B7.039100B12264226500A503920395039603970399039A039C03A603AB03A803A9.03AC039D00AC039F03A1224803A400AB00BB202600A003A503A7038603880153.20132015201C201D2018201900F70389038A038C038E03AD03AE03AF03CC038F.03CD03B103B203C803B403B503C603B303B70
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.3292041026777457
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8KTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjY4g4JysAWD:8KgmOEVIwAMiw/Pf2YRMFBEszD
                                                                                                                                                                                                                          MD5:6D52A84C06970CD3B2B7D8D1B4185CE6
                                                                                                                                                                                                                          SHA1:C434257D76A9FDF81CCCD8CC14242C8E3940FD89
                                                                                                                                                                                                                          SHA-256:633F5E3E75BF1590C94AB9CBF3538D0F0A7A319DB9016993908452D903D9C4FD
                                                                                                                                                                                                                          SHA-512:711F4DC86DD609823BF1BC5505DEE9FA3875A8AA7BCA31DC1B5277720C5ABE65B62E8A592FC55D99D1C7CA181FDDC2606551C43A9D12489B9FECFF152E9A3DCF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macIceland, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.00DD00B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC00D000F000DE00FE.00FD00B7201A201E203000C200CA00C100C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):48028
                                                                                                                                                                                                                          Entropy (8bit):3.3111639331656635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:ehuW1PJnT9TO7RaQiPCLUKr7KBi9FrOLdtHJ:eZPV9KuqTxFGXp
                                                                                                                                                                                                                          MD5:105B49F855C77AE0D3DED6C7130F93C2
                                                                                                                                                                                                                          SHA1:BA187C52FAE9792DA5BFFBEAA781FD4E0716E0F6
                                                                                                                                                                                                                          SHA-256:2A6856298EC629A16BDD924711DFE3F3B1E3A882DDF04B7310785D83EC0D566C
                                                                                                                                                                                                                          SHA-512:5B5FBE69D3B67AF863759D92D4A68481EC2211FF84ED9F0B3BD6129857966DE32B42A42432C44B9246C9D0D9C4C546CD3C6D13FF49BD338192C24AD053C0602E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macJapan, multi-byte.M.003F 0 46.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00A0FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1093
                                                                                                                                                                                                                          Entropy (8bit):3.3361385497578406
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8TTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdjBtRg4JysAWD:8TgmOEVIwAMiw/P32YRMTtRBEszD
                                                                                                                                                                                                                          MD5:30BECAE9EFD678B6FD1E08FB952A7DBE
                                                                                                                                                                                                                          SHA1:E4D8EA6A0E70BB793304CA21EB1337A7A2C26A31
                                                                                                                                                                                                                          SHA-256:68F22BAD30DAA81B215925416C1CC83360B3BB87EFC342058929731AC678FF37
                                                                                                                                                                                                                          SHA-512:E87105F7A5A983ACEAC55E93FA802C985B2B19F51CB3C222B4C13DDCF17C32D08DF323C829FB4CA33770B668485B7D14B7F6B0CF2287B0D76091DE2A675E88BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macRoman, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204420AC2039203AFB01FB02.202100B7201A201E203000C200CA00C100CB0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.342586490827578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8tTUmJvRju3ShVbsZiAMiZyb7P4SNMVZSxOZFYRMdj/TAg4JysAWD:8tgmOEVIwAMiw/P3AtYRMFTABEszD
                                                                                                                                                                                                                          MD5:C9AD5E42DA1D2C872223A14CC76F1D2B
                                                                                                                                                                                                                          SHA1:E257BD16EF34FDC29D5B6C985A1B45801937354C
                                                                                                                                                                                                                          SHA-256:71AE80ADFB437B7BC88F3C76FD37074449B3526E7AA5776D2B9FD5A43C066FA8
                                                                                                                                                                                                                          SHA-512:74588523D35A562AD4B1AF2B570596194D8C5018D5B44C8BA2B1F6BAD422D06E90172B0E65BB975663F3A3C246BCF2F598E9778BA86D1C5A51F5C0A38A2670EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macRomania, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A822600102015E.221E00B12264226500A500B522022211220F03C0222B00AA00BA21260103015F.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178204400A42039203A01620163.202100B7201A201E203000C200CA00C100C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1092
                                                                                                                                                                                                                          Entropy (8bit):3.539905812302991
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:88TUmJvRju3ShVbsZiAMiZyb7P4oJi8XPHmED43U/Tmh:88gmOEVIwAMiw/PNJpP43U0
                                                                                                                                                                                                                          MD5:163729C7C2B1F5A5DE1FB7866C93B102
                                                                                                                                                                                                                          SHA1:633D190B5E281CFC0178F6C11DD721C6A266F643
                                                                                                                                                                                                                          SHA-256:CEAD5EB2B0B44EF4003FBCB2E49CA0503992BA1D6540D11ACBBB84FDBBD6E79A
                                                                                                                                                                                                                          SHA-512:2093E3B59622E61F29276886911FAA50BA3AA9D903CAF8CB778A1D3FDB3D1F7DA43071AFC3672C27BE175E7EEBBC542B655A85533F41EA39F32E80663CAF3B44
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macThai, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00AB00BB2026F88CF88FF892F895F898F88BF88EF891F894F897201C201DF899.FFFD2022F884F889F885F886F887F888F88AF88DF890F893F89620182019FFFD.00A00E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3AFEFF200B201320140E3F.0E400E410E420E430E440E450E460E470E480E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.353168947106635
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8QjTUmJvRju3ShVbsZiAMiZyb7P4SNMVtOZm5YRMdD/g4JysD:88gmOEVIwAMiw/P32YRM9BEsD
                                                                                                                                                                                                                          MD5:F20CBBE1FF9289AC4CBAFA136A9D3FF1
                                                                                                                                                                                                                          SHA1:382E34824AD8B79EF0C98FD516750649FD94B20A
                                                                                                                                                                                                                          SHA-256:F703B7F74CC6F5FAA959F51C757C94623677E27013BCAE23BEFBA01A392646D9
                                                                                                                                                                                                                          SHA-512:23733B711614EA99D954E92C6035DAC1237866107FE11CDD5B0CD2A780F22B9B7B879570DB38C6B9195F54DAD9DFB0D60641AB37DFF3C51CF1A11D1D36471B2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macTurkish, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.00C400C500C700C900D100D600DC00E100E000E200E400E300E500E700E900E8.00EA00EB00ED00EC00EE00EF00F100F300F200F400F600F500FA00F900FB00FC.202000B000A200A300A7202200B600DF00AE00A9212200B400A8226000C600D8.221E00B12264226500A500B522022211220F03C0222B00AA00BA03A900E600F8.00BF00A100AC221A01922248220600AB00BB202600A000C000C300D501520153.20132014201C201D2018201900F725CA00FF0178011E011F01300131015E015F.202100B7201A201E203000C200CA00C100C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1095
                                                                                                                                                                                                                          Entropy (8bit):3.3460856516901947
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:8TzTUmJvRju3ShVbsZiAMiZyb7P4GE+SAJlM9aDpiR/Pk956e3cmq:8PgmOEVIwAMiw/Pr5NY3k9nsmq
                                                                                                                                                                                                                          MD5:92716A59D631BA3A352DE0872A5CF351
                                                                                                                                                                                                                          SHA1:A487946CB2EFD75FD748503D75E495720B53E5BC
                                                                                                                                                                                                                          SHA-256:4C94E7FBE183379805056D960AB624D78879E43278262E4D6B98AB78E5FEFEA8
                                                                                                                                                                                                                          SHA-512:863A667B6404ED02FE994089320EB0ECC34DC431D591D661277FB54A2055334DBEBCAAE1CA06FB8D190727EBA23A47B47991323BE35E74C182F83E5DEAA0D83B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: macUkraine, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0410041104120413041404150416041704180419041A041B041C041D041E041F.0420042104220423042404250426042704280429042A042B042C042D042E042F.202000B0049000A300A7202200B6040600AE00A9212204020452226004030453.221E00B122642265045600B504910408040404540407045704090459040A045A.0458040500AC221A01922248220600AB00BB202600A0040B045B040C045C0455.20132014201C201D2018201900F7201E040E045E040F045F211604010451044F.04300431043204330434043504360437043
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):41862
                                                                                                                                                                                                                          Entropy (8bit):3.4936148161949747
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:/huW1PJnT9TOZRaQiPCLUKr7KBi9FrOLdtY:/ZPV9KoqTxFGXY
                                                                                                                                                                                                                          MD5:8FBCB1BBC4B59D6854A8FCBF25853E0D
                                                                                                                                                                                                                          SHA1:2D56965B24125D999D1020C7C347B813A972647C
                                                                                                                                                                                                                          SHA-256:7502587D52E7810228F2ECB45AC4319EA0F5C008B7AC91053B920010DC6DDF94
                                                                                                                                                                                                                          SHA-512:128E66F384F9EA8F3E7FBEAD0D3AA1D45570EB3669172269A89AE3B522ED44E4572C6A5C9281B7E219579041D14FF0E76777A36E3902BFA1B58DC3DA729FA075
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: shiftjis, multi-byte.M.003F 0 40.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E007F.0080000000000000000000850086008700000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.0000FF61FF62FF63FF64FF65FF66FF67FF68FF69FF6AFF6BFF6CFF6DFF6EFF6F.FF70FF71FF72FF73FF74FF75FF76FF77FF78FF79FF7AFF7BFF7CFF7DFF7EFF7F.FF80FF81FF82FF83FF84FF85FF86FF87FF88FF89FF8AFF8BFF8CFF8DFF8EFF8F.FF90FF91FF92FF93FF94FF95FF96FF97FF98FF99FF9AFF9BFF9CFF9DFF9EFF9F.0000000000000000000000000000000000000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.675943323650254
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:Sd0UmJvRjuLoVoMQVoRmSdsTAsSnP9Us+yw4VivXObCXv:afmOEVoMQVoRmosTHSP9U/ydmXwCXv
                                                                                                                                                                                                                          MD5:1B612907F31C11858983AF8C009976D6
                                                                                                                                                                                                                          SHA1:F0C014B6D67FC0DC1D1BBC5F052F0C8B1C63D8BF
                                                                                                                                                                                                                          SHA-256:73FD2B5E14309D8C036D334F137B9EDF1F7B32DBD45491CF93184818582D0671
                                                                                                                                                                                                                          SHA-512:82D4A8F9C63F50E5D77DAD979D3A59729CD2A504E7159AE3A908B7D66DC02090DABD79B6A6DC7B998C32C383F804AACABC564A5617085E02204ADF0B13B13E5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: symbol, single-byte.S.003F 1 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002122000023220300250026220D002800292217002B002C2212002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.22450391039203A70394039503A603930397039903D1039A039B039C039D039F.03A0039803A103A303A403A503C203A9039E03A80396005B2234005D22A5005F.F8E503B103B203C703B403B503C603B303B703B903D503BA03BB03BC03BD03BF.03C003B803C103C303C403C503D603C903BE03C803B6007B007C007D223C007F.0080008100820083008400850086008700880089008A008B008C008D008E008F.0090009100920093009400950096009700980099009A009B009C009D009E009F.000003D2203222642044221E0192266326662665266021942190219121922193.00B000B12033226500D7221D2202202200F72260226122482026F8E6F8E721B5.21352111211C21182297229522052229222A2283228722842282228622082209.2220220700AE00A92122220F221A22C500AC2227222821D421D021D121D221D3.22C42329F8E8F8E9F8EA2211F8EBF8ECF8EDF8E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):2.9763240350841884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:ZlTUmJvRju3ShVbsZiAMiZyb7PNHmED43U/TW5dF:PgmOEVIwAMiw/PJ43UKF
                                                                                                                                                                                                                          MD5:7273E998972C9EFB2CEB2D5CD553DE49
                                                                                                                                                                                                                          SHA1:4AA47E6DF964366FA3C29A0313C0DAE0FA63A78F
                                                                                                                                                                                                                          SHA-256:330517F72738834ECBF4B6FA579F725B4B33AD9F4669975E727B40DF185751FF
                                                                                                                                                                                                                          SHA-512:56BF15C123083D3F04FE0C506EE8ECE4C08C17754F0CAAD3566F1469728CFD2F0A487023DCB26432240EB09F064944D3EF08175979F5D1D2BF734E7C7C609055
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Encoding file: tis-620, single-byte.S.003F 0 1.00.0000000100020003000400050006000700080009000A000B000C000D000E000F.0010001100120013001400150016001700180019001A001B001C001D001E001F.0020002100220023002400250026002700280029002A002B002C002D002E002F.0030003100320033003400350036003700380039003A003B003C003D003E003F.0040004100420043004400450046004700480049004A004B004C004D004E004F.0050005100520053005400550056005700580059005A005B005C005D005E005F.0060006100620063006400650066006700680069006A006B006C006D006E006F.0070007100720073007400750076007700780079007A007B007C007D007E0000.0000000000000000000000000000000000000000000000000000000000000000.0000000000000000000000000000000000000000000000000000000000000000.00000E010E020E030E040E050E060E070E080E090E0A0E0B0E0C0E0D0E0E0E0F.0E100E110E120E130E140E150E160E170E180E190E1A0E1B0E1C0E1D0E1E0E1F.0E200E210E220E230E240E250E260E270E280E290E2A0E2B0E2C0E2D0E2E0E2F.0E300E310E320E330E340E350E360E370E380E390E3A00000000000000000E3F.0E400E410E420E430E440E450E460E470E480E
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7900
                                                                                                                                                                                                                          Entropy (8bit):4.806010360595623
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:DXzSaH9ox7j4LaQMpsyGb0XEACrHpff6Jy8qNy6QRIt5QYTLa3QAQYplavQqQIL0:DpH9m7DPnQdg+Q
                                                                                                                                                                                                                          MD5:E8FD468CCD2EE620544FE204BDE2A59D
                                                                                                                                                                                                                          SHA1:2E26B7977D900EAA7D4908D5113803DF6F34FC59
                                                                                                                                                                                                                          SHA-256:9B6E400EB85440EC64AB66B4AC111546585740C9CA61FD156400D7153CBAD9F4
                                                                                                                                                                                                                          SHA-512:13A40A4BDE32F163CB789C69BD260ABF41C6771E7AC50FB122C727B9F39BE5D73E4D8BAE040DDDD94C5F2B901AB7C32D9C6BB62310121CA8DB4ADE25CB9AA4B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# history.tcl --.#.# Implementation of the history command..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#...# The tcl::history array holds the history list and some additional.# bookkeeping variables..#.# nextid.the index used for the next history list item..# keep..the max size of the history list.# oldest.the index of the oldest item in the history...namespace eval ::tcl {. variable history. if {![info exists history]} {..array set history {.. nextid.0.. keep.20.. oldest.-20..}. }.. namespace ensemble create -command ::tcl::history -map {..add.::tcl::HistAdd..change.::tcl::HistChange..clear.::tcl::HistClear..event.::tcl::HistEvent..info.::tcl::HistInfo..keep.::tcl::HistKeep..nextid.::tcl::HistNextID..redo.::tcl::HistRedo. }.}...# history --.#.#.This is the main history command. See the man page for its interface..#.This does s
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9689
                                                                                                                                                                                                                          Entropy (8bit):4.754346192989986
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:kQkH8VqqNg5PPx7GRpoMJesrCL2coOG0vARQVSDR6VrKj7vWQYQN81QvLbDdv:pVqeglpu6toO3ACUnvv
                                                                                                                                                                                                                          MD5:1DA12C32E7E4C040BD9AB2BCBAC5445B
                                                                                                                                                                                                                          SHA1:8E8659BEF065AF9430509BBDD5FB4CFE0EF14153
                                                                                                                                                                                                                          SHA-256:ACBFF9B5EF75790920B95023156FAD80B18AFF8CAFC4A6DC03893F9388E053A2
                                                                                                                                                                                                                          SHA-512:A269C76C1684EC1A2E2AA611ABB459AA3BE2973FD456737BC8C8D2E5C8BC53A26BBC1488062281CA87E38D548281166C4D775C50C695AEC9741FE911BB431EAD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# http.tcl.# Client-side HTTP for GET, POST, and HEAD commands..# These routines can be used in untrusted code that uses the Safesock.# security policy..# These procedures use a callback interface to avoid using vwait,.# which is not defined in the safe base..#.# See the http.n man page for documentation..package provide http 1.0..array set http {. -accept */*. -proxyhost {}. -proxyport {}. -useragent {Tcl http client package 1.0}. -proxyfilter httpProxyRequired.}.proc http_config {args} {. global http. set options [lsort [array names http -*]]. set usage [join $options ", "]. if {[llength $args] == 0} {..set result {}..foreach name $options {.. lappend result $name $http($name)..}..return $result. }. regsub -all -- - $options {} options. set pat ^-([join $options |])$. if {[llength $args] == 1} {..set flag [lindex $args 0]..if {[regexp -- $pat $flag]} {.. return $http($flag)..} else {.. return -code error "Unknown option $flag, must be:
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):735
                                                                                                                                                                                                                          Entropy (8bit):4.669068874824871
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:jHxxYRs+opS42wyGlTajUA43KXks4L57+HkuRz20JSv6C3l5kl:bbYRshS42wyGlTah9XkbL5i1z2jxXkl
                                                                                                                                                                                                                          MD5:10EC7CD64CA949099C818646B6FAE31C
                                                                                                                                                                                                                          SHA1:6001A58A0701DFF225E2510A4AAEE6489A537657
                                                                                                                                                                                                                          SHA-256:420C4B3088C9DACD21BC348011CAC61D7CB283B9BEE78AE72EED764AB094651C
                                                                                                                                                                                                                          SHA-512:34A0ACB689E430ED2903D8A903D531A3D734CB37733EF13C5D243CB9F59C020A3856AAD98726E10AD7F4D67619A3AF1018F6C3E53A6E073E39BD31D088EFD4AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl package index file, version 1.0.# This file is generated by the "pkg_mkIndex" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...package ifneeded http 1.0 [list tclPkgSetup $dir http 1.0 {{http.tcl source {httpCopyDone httpCopyStart httpEof httpEvent httpFinish httpMapReply httpProxyRequired http_code http_config http_data http_formatQuery http_get http_reset http_size http_status http_wait}}}].
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):24432
                                                                                                                                                                                                                          Entropy (8bit):4.824619671192163
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:U8Oh2gWD8Ud4zaJqacMQsRNLKx32LgWMOFaBBf6/9IrO1zWq8oXbjdEfdQxAp12Q:2OD8Ud4WJqJfcMOFt/9IrOBWq8oXwQxM
                                                                                                                                                                                                                          MD5:B900811A252BE90C693E5E7AE365869D
                                                                                                                                                                                                                          SHA1:345752C46F7E8E67DADEF7F6FD514BED4B708FC5
                                                                                                                                                                                                                          SHA-256:BC492B19308BC011CFCD321F1E6E65E6239D4EEB620CC02F7E9BF89002511D4A
                                                                                                                                                                                                                          SHA-512:36B8CDBA61B9222F65B055C0C513801F3278A3851912215658BCF0CE10F80197C1F12A5CA3054D8604DA005CE08DA8DCD303B8544706B642140A49C4377DD6CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# init.tcl --.#.# Default system startup file for Tcl-based applications. Defines.# "unknown" procedure and auto-load facilities..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-1999 Scriptics Corporation..# Copyright (c) 2004 by Kevin B. Kenny. All rights reserved..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# This test intentionally written in pre-7.5 Tcl.if {[info commands package] == ""} {. error "version mismatch: library\nscripts expect Tcl version 7.5b1 or later but the loaded version is\nonly [info patchlevel]".}.package require -exact Tcl 8.6.9..# Compute the auto path to use in this interpreter..# The values on the path come from several locations:.#.# The environment variable TCLLIBPATH.#.# tcl_library, which is the directory containing this init.tcl script..# [tclInit] (Tcl_Init()) sea
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):989
                                                                                                                                                                                                                          Entropy (8bit):4.015702624322247
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8wcm2NkKcmtH3WhvdfjESBToOqepFHvFgdF69dixmem1OMVjeza6O6c:4azu8DtkN3bbJ75pF9gG3U2e+gc
                                                                                                                                                                                                                          MD5:3A3B4D3B137E7270105DC7B359A2E5C2
                                                                                                                                                                                                                          SHA1:2089B3948F11EF8CE4BD3D57167715ADE65875E9
                                                                                                                                                                                                                          SHA-256:2981965BD23A93A09EB5B4A334ACB15D00645D645C596A5ECADB88BFA0B6A908
                                                                                                                                                                                                                          SHA-512:044602E7228D2CB3D0A260ADFD0D3A1F7CAB7EFE5DD00C7519EAF00A395A48A46EEFDB3DE81902D420D009B137030BC98FF32AD97E9C3713F0990FE6C09887A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af DAYS_OF_WEEK_ABBREV [list \. "So"\. "Ma"\. "Di"\. "Wo"\. "Do"\. "Vr"\. "Sa"]. ::msgcat::mcset af DAYS_OF_WEEK_FULL [list \. "Sondag"\. "Maandag"\. "Dinsdag"\. "Woensdag"\. "Donderdag"\. "Vrydag"\. "Saterdag"]. ::msgcat::mcset af MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset af MONTHS_FULL [list \. "Januarie"\. "Februarie"\. "Maart"\. "April"\. "Mei"\. "Junie"\. "Julie"\. "Augustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""]. ::msgcat::mcset af AM "VM". ::msgcat::mcset af PM "NM".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.879621059534584
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmouFygvNLouFqF3v6aZouFy9+3vR6HK:4EnLzu8YAgvNTYF3v6axAI3voq
                                                                                                                                                                                                                          MD5:27C356DF1BED4B22DFA55835115BE082
                                                                                                                                                                                                                          SHA1:677394DF81CDBAF3D3E735F4977153BB5C81B1A6
                                                                                                                                                                                                                          SHA-256:3C2F5F631ED3603EF0D5BCB31C51B2353C5C27839C806A036F3B7007AF7F3DE8
                                                                                                                                                                                                                          SHA-512:EE88348C103382F91F684A09F594177119960F87E58C5E4FC718C698AD436E332B74B8ED18DF8563F736515A3A6442C608EBCBE6D1BD13B3E3664E1AA3851076
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset af_ZA DATE_FORMAT "%d %B %Y". ::msgcat::mcset af_ZA TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset af_ZA DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1964
                                                                                                                                                                                                                          Entropy (8bit):4.417722751563065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8fnkFewadQxvbkMPm/FiUoAwonC9UFsvSnvMq:46dw/L+C9cKSvF
                                                                                                                                                                                                                          MD5:0A88A6BFF15A6DABAAE48A78D01CFAF1
                                                                                                                                                                                                                          SHA1:90834BCBDA9B9317B92786EC89E20DCF1F2DBD22
                                                                                                                                                                                                                          SHA-256:BF984EC7CF619E700FE7E00381FF58ABE9BD2F4B3DD622EB2EDACCC5E6681050
                                                                                                                                                                                                                          SHA-512:85CB96321BB6FB3119D69540B9E76916F0C5F534BA01382E73F8F9A0EE67A7F1BFC39947335688F2C8F3DB9B51D969D8EA7C7104A035C0E949E8E009D4656288
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar DAYS_OF_WEEK_ABBREV [list \. "\u062d"\. "\u0646"\. "\u062b"\. "\u0631"\. "\u062e"\. "\u062c"\. "\u0633"]. ::msgcat::mcset ar DAYS_OF_WEEK_FULL [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar MONTHS_ABBREV [list \. "\u064a\u0646\u0627"\. "\u0641\u0628\u0631"\. "\u0645\u0627\u0631"\. "\u0623\u0628\u0631"\. "\u0645\u0627\u064a"\. "\u064a\u0648\u0646"\. "\u064a\u0648\u0644"\. "\u0623\u063a\u0633"\. "\u0633\u0628\u062a"\. "\u0623\u0643\u062a"\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):259
                                                                                                                                                                                                                          Entropy (8bit):4.825452591398057
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoKNvf/NLoKU3v6xH5oKNo+3vfXM6PYv:4EnLzu8yvf/Nq3v6vF3vfc6q
                                                                                                                                                                                                                          MD5:EEB42BA91CC7EF4F89A8C1831ABE7B03
                                                                                                                                                                                                                          SHA1:74D12B4CBCDF63FDF00E589D8A604A5C52C393EF
                                                                                                                                                                                                                          SHA-256:29A70EAC43B1F3AA189D8AE4D92658E07783965BAE417FB66EE5F69CFCB564F3
                                                                                                                                                                                                                          SHA-512:6CCB2F62986CE1CF3CE78538041A0E4AAF717496F965D73014A13E9B05093EB43185C3C14212DC052562F3F369AB6985485C8C93D1DFC60CF9B8DABEA7CDF434
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_IN DATE_FORMAT "%A %d %B %Y". ::msgcat::mcset ar_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ar_IN DATE_TIME_FORMAT "%A %d %B %Y %I:%M:%S %z %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1812
                                                                                                                                                                                                                          Entropy (8bit):4.023830561129656
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8J5Fe6k+wR+9Gb+Oa+UcP+wR+9Gb+Oa+UD:46I6CNbtdNbQ
                                                                                                                                                                                                                          MD5:4338BD4F064A6CDC5BFED2D90B55D4E8
                                                                                                                                                                                                                          SHA1:709717BB1F62A71E94D61056A70660C6A03B48AE
                                                                                                                                                                                                                          SHA-256:78116E7E706C7D1E3E7446094709819FB39A50C2A2302F92D6A498E06ED4A31B
                                                                                                                                                                                                                          SHA-512:C63A535AD19CBEF5EFC33AC5A453B1C503A59C6CE71A4CABF8083BC516DF0F3F14D3D4F309D33EDF2EC5E79DB00ED1F7D56FD21068F09F178BB2B191603BAC25
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_JO DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_JO MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1812
                                                                                                                                                                                                                          Entropy (8bit):4.020656526954981
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu865Fehk+wR+9Gb+Oa+UXP+wR+9Gb+Oa+UD:46nhCNbadNbQ
                                                                                                                                                                                                                          MD5:3789E03CF926D4F12AFD30FC7229B78D
                                                                                                                                                                                                                          SHA1:AEF38AAB736E5434295C72C14F38033AAFE6EF15
                                                                                                                                                                                                                          SHA-256:7C970EFEB55C53758143DF42CC452A3632F805487CA69DB57E37C1F478A7571B
                                                                                                                                                                                                                          SHA-512:C9172600703337EDB2E36D7470A3AED96CCC763D7163067CB19E7B097BB7877522758C3109E31D5D72F486DD50BF510DDBA50EDD248B899FA0A2EEF09FCBF903
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_LB DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_LB MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1812
                                                                                                                                                                                                                          Entropy (8bit):4.02203966019266
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8k5Fezk+wR+9Gb+Oa+U5P+wRa9Gb+Oa+UD:46ZzCNb0d5bQ
                                                                                                                                                                                                                          MD5:EC736BFD4355D842E5BE217A7183D950
                                                                                                                                                                                                                          SHA1:C6B83C02F5D4B14064D937AFD8C6A92BA9AE9EFB
                                                                                                                                                                                                                          SHA-256:AEF17B94A0DB878E2F0FB49D982057C5B663289E3A8E0E2B195DCEC37E8555B1
                                                                                                                                                                                                                          SHA-512:68BB7851469C24003A9D74FC7FE3599A2E95EE3803014016DDEBF4C5785F49EDBADA69CD4103F2D3B6CE91E9A32CC432DBDFEC2AED0557E5B6B13AED489A1EDA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ar_SY DAYS_OF_WEEK_ABBREV [list \. "\u0627\u0644\u0623\u062d\u062f"\. "\u0627\u0644\u0627\u062b\u0646\u064a\u0646"\. "\u0627\u0644\u062b\u0644\u0627\u062b\u0627\u0621"\. "\u0627\u0644\u0623\u0631\u0628\u0639\u0627\u0621"\. "\u0627\u0644\u062e\u0645\u064a\u0633"\. "\u0627\u0644\u062c\u0645\u0639\u0629"\. "\u0627\u0644\u0633\u0628\u062a"]. ::msgcat::mcset ar_SY MONTHS_ABBREV [list \. "\u0643\u0627\u0646\u0648\u0646 \u0627\u0644\u062b\u0627\u0646\u064a"\. "\u0634\u0628\u0627\u0637"\. "\u0622\u0630\u0627\u0631"\. "\u0646\u064a\u0633\u0627\u0646"\. "\u0646\u0648\u0627\u0631"\. "\u062d\u0632\u064a\u0631\u0627\u0646"\. "\u062a\u0645\u0648\u0632"\. "\u0622\u0628"\. "\u0623\u064a\u0644\u0648\u0644"\. "\u062a\u0634\u0631\u064a\u0646 \u0627\u0644\u0623\u0648\u0644"\. "\u062a\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2105
                                                                                                                                                                                                                          Entropy (8bit):4.215818273236158
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46dJRQPQ86AK0xQuEQS3oQsDptuCrQICZmQ8ZVDtN1QFqQLtCSjZMpktvp:hdP6HIZoFnl1Rgx
                                                                                                                                                                                                                          MD5:1A3ABFBC61EF757B45FF841C197BB6C3
                                                                                                                                                                                                                          SHA1:74D623DAB6238D05C18DDE57FC956D84974FC2D4
                                                                                                                                                                                                                          SHA-256:D790E54217A4BF9A7E1DCB4F3399B5861728918E93CD3F00B63F1349BDB71C57
                                                                                                                                                                                                                          SHA-512:154D053410AA0F7817197B7EE1E8AE839BA525C7660620581F228477B1F5B972FE95A4E493BB50365D0B63B0115036DDE54A98450CA4E8048AF5D0AF092BADE5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset be DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0430\u0442"\. "\u0441\u0440"\. "\u0447\u0446"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset be DAYS_OF_WEEK_FULL [list \. "\u043d\u044f\u0434\u0437\u0435\u043b\u044f"\. "\u043f\u0430\u043d\u044f\u0434\u0437\u0435\u043b\u0430\u043a"\. "\u0430\u045e\u0442\u043e\u0440\u0430\u043a"\. "\u0441\u0435\u0440\u0430\u0434\u0430"\. "\u0447\u0430\u0446\u0432\u0435\u0440"\. "\u043f\u044f\u0442\u043d\u0456\u0446\u0430"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset be MONTHS_ABBREV [list \. "\u0441\u0442\u0434"\. "\u043b\u044e\u0442"\. "\u0441\u043a\u0432"\. "\u043a\u0440\u0441"\. "\u043c\u0430\u0439"\. "\u0447\u0440\u0432"\. "\u043b\u043f\u043d"\. "\u0436\u043d\u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1819
                                                                                                                                                                                                                          Entropy (8bit):4.363233187157474
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46scAXuQfuQVoQAWN5EPIKfD8WQjQ3QgQaQLSqQsQGtQWCQMmt1f:hD/zQaPIKfTSiF3KVfVCqp
                                                                                                                                                                                                                          MD5:11FA3BA30A0EE6A7B2B9D67B439C240D
                                                                                                                                                                                                                          SHA1:EC5557A16A0293ABF4AA8E5FD50940B60A8A36A6
                                                                                                                                                                                                                          SHA-256:E737D8DC724AA3B9EC07165C13E8628C6A8AC1E80345E10DC77E1FC62A6D86F1
                                                                                                                                                                                                                          SHA-512:B776E7C98FB819436C61665206EE0A2644AA4952D739FF7CC58EAFBD549BD1D26028DE8E11B8533814102B31FC3884F95890971F547804BCAA4530E35BDD5CFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bg DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0434"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset bg DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u043b\u044f"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0412\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0421\u0440\u044f\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u044a\u0440\u0442\u044a\u043a"\. "\u041f\u0435\u0442\u044a\u043a"\. "\u0421\u044a\u0431\u043e\u0442\u0430"]. ::msgcat::mcset bg MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset bg MONTHS_FULL [list \. "\u042
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2286
                                                                                                                                                                                                                          Entropy (8bit):4.04505151160981
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8adWa9tUEVcqVc5VcaUTVcHVEVc+7VclEVcNGVcn0VcMG/0VcMjVcMK7YXs+:46C07LetHigetH1YES
                                                                                                                                                                                                                          MD5:B387D4A2AB661112F2ABF57CEDAA24A5
                                                                                                                                                                                                                          SHA1:80DB233687A9314600317AD39C01466C642F3C4C
                                                                                                                                                                                                                          SHA-256:297D4D7CAE6E99DB3CA6EE793519512BFF65013CF261CF90DED4D28D3D4F826F
                                                                                                                                                                                                                          SHA-512:450BB56198AAAB2EEFCD4E24C29DD79D71D2EF7E8D066F3B58F9C5D831F960AFB78C46ECE2DB32EF81454BCCC80C730E36A610DC9BAF06757E0757B421BACB19
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn DAYS_OF_WEEK_ABBREV [list \. "\u09b0\u09ac\u09bf"\. "\u09b8\u09cb\u09ae"\. "\u09ae\u0999\u0997\u09b2"\. "\u09ac\u09c1\u09a7"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf"\. "\u09b6\u09c1\u0995\u09cd\u09b0"\. "\u09b6\u09a8\u09bf"]. ::msgcat::mcset bn DAYS_OF_WEEK_FULL [list \. "\u09b0\u09ac\u09bf\u09ac\u09be\u09b0"\. "\u09b8\u09cb\u09ae\u09ac\u09be\u09b0"\. "\u09ae\u0999\u0997\u09b2\u09ac\u09be\u09b0"\. "\u09ac\u09c1\u09a7\u09ac\u09be\u09b0"\. "\u09ac\u09c3\u09b9\u09b8\u09cd\u09aa\u09a4\u09bf\u09ac\u09be\u09b0"\. "\u09b6\u09c1\u0995\u09cd\u09b0\u09ac\u09be\u09b0"\. "\u09b6\u09a8\u09bf\u09ac\u09be\u09b0"]. ::msgcat::mcset bn MONTHS_ABBREV [list \. "\u099c\u09be\u09a8\u09c1\u09df\u09be\u09b0\u09c0"\. "\u09ab\u09c7\u09ac\u09cd\u09b0\u09c1\u09df\u09be\u09b0\u09c0"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):259
                                                                                                                                                                                                                          Entropy (8bit):4.821338044395148
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmovtvflD/Lo/E3v6xH5ovto+3vflm6PYv:4EnLzu81tvflD/SE3v6etF3vflm6q
                                                                                                                                                                                                                          MD5:764E70363A437ECA938DEC17E615608B
                                                                                                                                                                                                                          SHA1:2296073AE8CC421780E8A3BCD58312D6FB2F5BFC
                                                                                                                                                                                                                          SHA-256:7D3A956663C529D07C8A9610414356DE717F3A2A2CE9B331B052367270ACEA94
                                                                                                                                                                                                                          SHA-512:4C7B9082DA9DDF07C2BE16C359A1A42834B8E730AD4DD5B987866C2CC735402DDE513588A89C8DFA25A1AC6F66AF9FDDBEA8FD500F8526C4641BBA7011CD0D28
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset bn_IN DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset bn_IN TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset bn_IN DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1102
                                                                                                                                                                                                                          Entropy (8bit):4.213250101046006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8WBVUUQ48wsF0nuLsCtJeUFqwv1v3:46BwoL5ScfR3
                                                                                                                                                                                                                          MD5:9378A5AD135137759D46A7CC4E4270E0
                                                                                                                                                                                                                          SHA1:8D2D53DA208BB670A335C752DFC4B4FF4509A799
                                                                                                                                                                                                                          SHA-256:14FF564FAB584571E954BE20D61C2FACB096FE2B3EF369CC5ECB7C25C2D92D5A
                                                                                                                                                                                                                          SHA-512:EF784D0D982BA0B0CB37F1DA15F8AF3BE5321F59E586DBED1EDD0B3A38213D3CEA1CDFC983A025418403400CCE6039B786EE35694A5DFCE1F22CB2D315F5FCF8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ca DAYS_OF_WEEK_ABBREV [list \. "dg."\. "dl."\. "dt."\. "dc."\. "dj."\. "dv."\. "ds."]. ::msgcat::mcset ca DAYS_OF_WEEK_FULL [list \. "diumenge"\. "dilluns"\. "dimarts"\. "dimecres"\. "dijous"\. "divendres"\. "dissabte"]. ::msgcat::mcset ca MONTHS_ABBREV [list \. "gen."\. "feb."\. "mar\u00e7"\. "abr."\. "maig"\. "juny"\. "jul."\. "ag."\. "set."\. "oct."\. "nov."\. "des."\. ""]. ::msgcat::mcset ca MONTHS_FULL [list \. "gener"\. "febrer"\. "mar\u00e7"\. "abril"\. "maig"\. "juny"\. "juliol"\. "agost"\. "setembre"\. "octubre"\. "novembre"\. "desembre"\. ""]. ::msgcat::mcset ca DATE_FORMAT "%d/%m/%Y". ::msg
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1300
                                                                                                                                                                                                                          Entropy (8bit):4.400184537938628
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8f4sO4fETEtd3N5EPIK+kJQz3R3VJ2PYYITCF3eYGCvt2/v3eG:46/ETKN5EPIKfsxV+pBtMJ
                                                                                                                                                                                                                          MD5:4C5679B0880394397022A70932F02442
                                                                                                                                                                                                                          SHA1:CA5C47A76CD4506D8E11AECE1EA0B4A657176019
                                                                                                                                                                                                                          SHA-256:49CF452EEF0B8970BC56A7B8E040BA088215508228A77032CBA0035522412F86
                                                                                                                                                                                                                          SHA-512:39FA0D3235FFD3CE2BCCFFFA6A4A8EFE2668768757DAFDE901917731E20AD15FCAC4E48CF4ACF0ADFAA38CC72768FD8F1B826464B0F71A1C784E334AE72F857C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset cs DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "\u00dat"\. "St"\. "\u010ct"\. "P\u00e1"\. "So"]. ::msgcat::mcset cs DAYS_OF_WEEK_FULL [list \. "Ned\u011ble"\. "Pond\u011bl\u00ed"\. "\u00dater\u00fd"\. "St\u0159eda"\. "\u010ctvrtek"\. "P\u00e1tek"\. "Sobota"]. ::msgcat::mcset cs MONTHS_ABBREV [list \. "I"\. "II"\. "III"\. "IV"\. "V"\. "VI"\. "VII"\. "VIII"\. "IX"\. "X"\. "XI"\. "XII"\. ""]. ::msgcat::mcset cs MONTHS_FULL [list \. "leden"\. "\u00fanor"\. "b\u0159ezen"\. "duben"\. "kv\u011bten"\. "\u010derven"\. "\u010dervenec"\. "srpen"\. "z\u00e1\u0159\u00ed"\. "\u0159\u00edjen"\. "listopad"\. "prosinec"\. ""]
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1156
                                                                                                                                                                                                                          Entropy (8bit):4.242018456508518
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8xVKE6V4/xPsS9CfXTBfijQT1GqAPwvsvT:461H6y/RsJXTNGqAuKT
                                                                                                                                                                                                                          MD5:F012F45523AA0F8CFEACC44187FF1243
                                                                                                                                                                                                                          SHA1:B171D1554244D2A6ED8DE17AC8000AA09D2FADE9
                                                                                                                                                                                                                          SHA-256:CA58FF5BAA9681D9162E094E833470077B7555BB09EEE8E8DD41881B108008A0
                                                                                                                                                                                                                          SHA-512:5BBC44471AB1B1622FABC7A12A8B8727087BE64BEAF72D2C3C9AAC1246A41D9B7CAFC5C451F24A3ACC681C310BF47BBC3384CF80EB0B4375E12646CB7BB8FFD5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset da DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset da DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset da MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset da MONTHS_FULL [list \. "januar"\. "februar"\. "marts"\. "april"\. "maj"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset da BCE "f.Kr.". ::msgcat::mcset da CE "e.Kr.".
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1222
                                                                                                                                                                                                                          Entropy (8bit):4.277486792653572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8byFouxpZzWsu0biMe5pF9g1tT9egQTqrS8QWmWFUvIvWI3:46CFB/ZzWsu0vpHlrS8QLWFSeWI3
                                                                                                                                                                                                                          MD5:68882CCA0886535A613ECFE528BB81FC
                                                                                                                                                                                                                          SHA1:6ABF519F6E4845E6F13F272D628DE97F2D2CD481
                                                                                                                                                                                                                          SHA-256:CC3672969C1DD223EADD9A226E00CAC731D8245532408B75AB9A70E9EDD28673
                                                                                                                                                                                                                          SHA-512:ACD5F811A0494E04A18035D2B9171FAF3AB8C856AAB0C09AEBE755590261066ADCD2750565F1CB840B2D0111D95C98970294550A4FBD00E4346D2EDBA3A5C957
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de DAYS_OF_WEEK_ABBREV [list \. "So"\. "Mo"\. "Di"\. "Mi"\. "Do"\. "Fr"\. "Sa"]. ::msgcat::mcset de DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mrz"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de BCE "v. Chr.". ::msgcat::mcset de CE "n. Chr.".
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):812
                                                                                                                                                                                                                          Entropy (8bit):4.344116560816791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8U3S5dkTo7eqepFHvFgt1BAI+5zS17eM5Qz3q6owjI9I3vd3v6B3v9dy:4azu8UlMe5pF9gXDT9egQTqr+rv1vivi
                                                                                                                                                                                                                          MD5:63B8EBBA990D1DE3D83D09375E19F6AC
                                                                                                                                                                                                                          SHA1:B7714AF372B4662A0C15DDBC0F80D1249CB1EEBD
                                                                                                                                                                                                                          SHA-256:80513A9969A12A8FB01802D6FC3015712A4EFDDA64552911A1BB3EA7A098D02C
                                                                                                                                                                                                                          SHA-512:638307C9B97C74BAF38905AC88E73B57F24282E40929DA43ADB74978040B818EFCC2EE2A377DFEB3AC9050800536F2BE1C7C2A7AB9E7B8BCF8D15E5F293F24D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_AT MONTHS_ABBREV [list \. "J\u00e4n"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_AT MONTHS_FULL [list \. "J\u00e4nner"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_AT DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset de_AT TIME_FORMAT "%T". ::msgcat::mcset de_AT TIME_FORMAT_12 "%T". ::msgcat::mcset de_AT DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1223
                                                                                                                                                                                                                          Entropy (8bit):4.319193323810203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8I8VWRFFAVa8VpZzWsuEbkMe5pF9grtT9egQTqr9u5sevOevmDvi:46kR6VaIZzWsuEJnHlrg5soOomzi
                                                                                                                                                                                                                          MD5:A741CF1A27C77CFF2913076AC9EE9DDC
                                                                                                                                                                                                                          SHA1:DE519D3A86DCF1E8F469490967AFE350BAEAFE01
                                                                                                                                                                                                                          SHA-256:7573581DEC27E90B0C7D34057D9F4EF89727317D55F2C4E0428A47740FB1EB7A
                                                                                                                                                                                                                          SHA-512:C9272793BAA1D33C32576B48756063F4A9BB97E8FFA276809CF4C3956CC457E48C577BDF359C1ECF5CF665A68135CAED17E972DC053A6AFBAAC3BA0ECBAFEB05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset de_BE DAYS_OF_WEEK_ABBREV [list \. "Son"\. "Mon"\. "Die"\. "Mit"\. "Don"\. "Fre"\. "Sam"]. ::msgcat::mcset de_BE DAYS_OF_WEEK_FULL [list \. "Sonntag"\. "Montag"\. "Dienstag"\. "Mittwoch"\. "Donnerstag"\. "Freitag"\. "Samstag"]. ::msgcat::mcset de_BE MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "M\u00e4r"\. "Apr"\. "Mai"\. "Jun"\. "Jul"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset de_BE MONTHS_FULL [list \. "Januar"\. "Februar"\. "M\u00e4rz"\. "April"\. "Mai"\. "Juni"\. "Juli"\. "August"\. "September"\. "Oktober"\. "November"\. "Dezember"\. ""]. ::msgcat::mcset de_BE AM "vorm". ::msgcat::mcs
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2252
                                                                                                                                                                                                                          Entropy (8bit):4.313031807335687
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8+v+39bYW4v+0Wn4Obg+EKkJQg9UWWY+YcYGV97Wu9TJGJABRF6RrJFdsvjt:468XxCSpAWL8jdL
                                                                                                                                                                                                                          MD5:E152787B40C5E30699AD5E9B0C60DC07
                                                                                                                                                                                                                          SHA1:4FB9DB6E784E1D28E632B55ED31FBBB4997BF575
                                                                                                                                                                                                                          SHA-256:9B2F91BE34024FBCF645F6EF92460E5F944CA6A16268B79478AB904B2934D357
                                                                                                                                                                                                                          SHA-512:DE59E17CAB924A35C4CC74FE8FCA4776BD49E30C224E476741A273A74BBE40CDAAEDBF6BBB5E30011CD0FEED6B2840F607FD0F1BD3E136E7FE39BAE81C7ED4DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset el DAYS_OF_WEEK_ABBREV [list \. "\u039a\u03c5\u03c1"\. "\u0394\u03b5\u03c5"\. "\u03a4\u03c1\u03b9"\. "\u03a4\u03b5\u03c4"\. "\u03a0\u03b5\u03bc"\. "\u03a0\u03b1\u03c1"\. "\u03a3\u03b1\u03b2"]. ::msgcat::mcset el DAYS_OF_WEEK_FULL [list \. "\u039a\u03c5\u03c1\u03b9\u03b1\u03ba\u03ae"\. "\u0394\u03b5\u03c5\u03c4\u03ad\u03c1\u03b1"\. "\u03a4\u03c1\u03af\u03c4\u03b7"\. "\u03a4\u03b5\u03c4\u03ac\u03c1\u03c4\u03b7"\. "\u03a0\u03ad\u03bc\u03c0\u03c4\u03b7"\. "\u03a0\u03b1\u03c1\u03b1\u03c3\u03ba\u03b5\u03c5\u03ae"\. "\u03a3\u03ac\u03b2\u03b2\u03b1\u03c4\u03bf"]. ::msgcat::mcset el MONTHS_ABBREV [list \. "\u0399\u03b1\u03bd"\. "\u03a6\u03b5\u03b2"\. "\u039c\u03b1\u03c1"\. "\u0391\u03c0\u03c1"\. "\u039c\u03b1\u03ca"\. "\u0399\u03bf\u03c5\u03bd"\. "\u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):300
                                                                                                                                                                                                                          Entropy (8bit):4.849761581276844
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoCwmGjbJFLoCws6W3vULoCws6W3v6p6HH5oCwmT+3vjb0y6:4EnLzu8brJFqs6W3v3s6W3v6QQJ3vK
                                                                                                                                                                                                                          MD5:F8AE50E60590CC1FF7CCC43F55B5B8A8
                                                                                                                                                                                                                          SHA1:52892EDDFA74DD4C8040F9CDD19A9536BFF72B6E
                                                                                                                                                                                                                          SHA-256:B85C9A373FF0F036151432652DD55C182B0704BD0625EA84BED1727EC0DE3DD8
                                                                                                                                                                                                                          SHA-512:8E15C9CA9A7D2862FDBA330F59BB177B06E5E3154CF3EA948B8E4C0282D66E75E18C225F28F6A203B4643E8BCAA0B5BDB59578A4C20D094F8B923650796E2E72
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_AU DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_AU TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_AU TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_AU DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):305
                                                                                                                                                                                                                          Entropy (8bit):4.823881517188826
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoCr3FD/LoCsX3vtfNrFLoCsX3v6YNn5oCs+3v3FnN9:4EnLzu863FD/U3vtNm3v6yt3v3FnN9
                                                                                                                                                                                                                          MD5:A0BB5A5CC6C37C12CB24523198B82F1C
                                                                                                                                                                                                                          SHA1:B7A6B4BFB6533CC33A0A0F5037E55A55958C4DFC
                                                                                                                                                                                                                          SHA-256:596AC02204C845AA74451FC527645549F2A3318CB63051FCACB2BF948FD77351
                                                                                                                                                                                                                          SHA-512:9859D8680E326C2EB39390F3B96AC0383372433000A4E828CF803323AB2AB681B2BAE87766CB6FB23F6D46DBA38D3344BC4A941AFB0027C737784063194F9AE4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BE DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_BE TIME_FORMAT "%k:%M:%S". ::msgcat::mcset en_BE TIME_FORMAT_12 "%k h %M min %S s %z". ::msgcat::mcset en_BE DATE_TIME_FORMAT "%d %b %Y %k:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.869619023232552
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmosmGvNLoss6W3v6aZosmT+3vR6HK:4EnLzu8WrvNbs6W3v6aBJ3voq
                                                                                                                                                                                                                          MD5:ECC735522806B18738512DC678D01A09
                                                                                                                                                                                                                          SHA1:EEEC3A5A3780DBA7170149C779180748EB861B86
                                                                                                                                                                                                                          SHA-256:340804F73B620686AB698B2202191D69227E736B1652271C99F2CFEF03D72296
                                                                                                                                                                                                                          SHA-512:F46915BD68249B5B1988503E50EBC48C13D9C0DDBDCBA9F520386E41A0BAAE640FD97A5085698AB1DF65640CE70AC63ED21FAD49AF54511A5543D1F36247C22D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_BW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_BW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_BW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):288
                                                                                                                                                                                                                          Entropy (8bit):4.828989678102087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoAhgqH5oAZF3vGoAZF3v6loAh9+3vnFDLq:4EnLzu8mhgqHFZF3vGZF3v65hI3v9G
                                                                                                                                                                                                                          MD5:F9A9EE00A4A2A899EDCCA6D82B3FA02A
                                                                                                                                                                                                                          SHA1:BFDBAD5C0A323A37D5F91C37EC899B923DA5B0F5
                                                                                                                                                                                                                          SHA-256:C9FE2223C4949AC0A193F321FC0FD7C344A9E49A54B00F8A4C30404798658631
                                                                                                                                                                                                                          SHA-512:4E5471ADE75E0B91A02A30D8A042791D63565487CBCA1825EA68DD54A3AE6F1E386D9F3B016D233406D4B0B499B05DF6295BC0FFE85E8AA9DA4B4B7CC0128AD9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_CA DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_CA TIME_FORMAT "%r". ::msgcat::mcset en_CA TIME_FORMAT_12 "%I:%M:%S %p". ::msgcat::mcset en_CA DATE_TIME_FORMAT "%a %d %b %Y %r %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.84511182583436
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoEbtvqH5oELE3vG5oELE3v6X5oEbto+3vnFDoAov:4EnLzu8ibtvqHBLE3v4LE3v6RbtF3v98
                                                                                                                                                                                                                          MD5:07C16C81F1B59444508D0F475C2DB175
                                                                                                                                                                                                                          SHA1:DEDBDB2C9ACA932C373C315FB6C5691DBEDEB346
                                                                                                                                                                                                                          SHA-256:AE38AD5452314B0946C5CB9D3C89CDFC2AD214E146EB683B8D0CE3FE84070FE1
                                                                                                                                                                                                                          SHA-512:F13333C975E6A0AD06E57C5C1908ED23C4A96008A895848D1E2FE7985001B2E5B9B05C4824C74EDA94E0CC70EC7CABCB103B97E54E957F986D8F277EEC3325B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_GB DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_GB TIME_FORMAT "%T". ::msgcat::mcset en_GB TIME_FORMAT_12 "%T". ::msgcat::mcset en_GB DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):321
                                                                                                                                                                                                                          Entropy (8bit):4.803235346516854
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoa/5oaQ9woaAx/G4FLoaYYW3v6aZoaAx/T+3v4x6HK:4EnLzu8cpZF4F7xW3v6ah/3v4Iq
                                                                                                                                                                                                                          MD5:27B4185EB5B4CAAD8F38AE554231B49A
                                                                                                                                                                                                                          SHA1:67122CAA8ECA829EC0759A0147C6851A6E91E867
                                                                                                                                                                                                                          SHA-256:C9BE2C9AD31D516B508D01E85BCCA375AAF807D6D8CD7C658085D5007069FFFD
                                                                                                                                                                                                                          SHA-512:003E5C1E2ECCCC48D14F3159DE71A5B0F1471275D4051C7AC42A3CFB80CAF651A5D04C4D8B868158211E8BC4E08554AF771993B0710E6625AA3AE912A33F5487
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_HK AM "AM". ::msgcat::mcset en_HK PM "PM". ::msgcat::mcset en_HK DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_HK TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_HK DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.78446779523026
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoK6qH5oKi+3vG5oKi+3v6X5oKv+3vnFDoAov:4EnLzu8vqHr3vQ3v6O3v9dy
                                                                                                                                                                                                                          MD5:30E351D26DC3D514BC4BF4E4C1C34D6F
                                                                                                                                                                                                                          SHA1:FA87650F840E691643F36D78F7326E925683D0A8
                                                                                                                                                                                                                          SHA-256:E7868C80FD59D18BB15345D29F5292856F639559CFFD42EE649C16C7938BF58D
                                                                                                                                                                                                                          SHA-512:5AAC8A55239A909207E73EFB4123692D027F7728157D07FAFB629AF5C6DB84B35CF11411E561851F7CDB6F25AEC174E85A1982C4B79C7586644E74512F5FBDDA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset en_IE TIME_FORMAT "%T". ::msgcat::mcset en_IE TIME_FORMAT_12 "%T". ::msgcat::mcset en_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):310
                                                                                                                                                                                                                          Entropy (8bit):4.756550208645364
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoKr3v5oKrGaoKr5vvNLoKrw3vULoKr5o+3voA6:4EnLzu8si2vvNa3vuF3vo3
                                                                                                                                                                                                                          MD5:1423A9CF5507A198580D84660D829133
                                                                                                                                                                                                                          SHA1:70362593A2B04CF965213F318B10E92E280F338D
                                                                                                                                                                                                                          SHA-256:71E5367FE839AFC4338C50D450F111728E097538ECACCC1B17B10238001B0BB1
                                                                                                                                                                                                                          SHA-512:C4F1AD41D44A2473531247036BEEF8402F7C77A21A33690480F169F35E78030942FD31C9331A82B8377D094E22D506C785D0311DBB9F1C2B4AD3575B3F0E76E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_IN AM "AM". ::msgcat::mcset en_IN PM "PM". ::msgcat::mcset en_IN DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_IN TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_IN DATE_TIME_FORMAT "%d %B %Y %H:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):300
                                                                                                                                                                                                                          Entropy (8bit):4.89415873600679
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoyejbJFLo63vULo63v6p6HH5oy7+3vjb0y6:4EnLzu8YeJFL3vI3v6QtS3vK
                                                                                                                                                                                                                          MD5:DB734349F7A1A83E1CB18814DB6572E8
                                                                                                                                                                                                                          SHA1:3386B2599C7C170A03E4EED68C39EAC7ADD01708
                                                                                                                                                                                                                          SHA-256:812DB204E4CB8266207A4E948FBA3DD1EFE4D071BBB793F9743A4320A1CEEBE3
                                                                                                                                                                                                                          SHA-512:EF09006552C624A2F1C62155251A18BDA9EE85C9FC81ABBEDE8416179B1F82AD0D88E42AB0A10B4871EF4B7DB670E4A824392339976C3C95FB31F588CDE5840D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_NZ DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset en_NZ TIME_FORMAT "%H:%M:%S". ::msgcat::mcset en_NZ TIME_FORMAT_12 "%I:%M:%S %P %z". ::msgcat::mcset en_NZ DATE_TIME_FORMAT "%e/%m/%Y %H:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):321
                                                                                                                                                                                                                          Entropy (8bit):4.775448167269054
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoJ5oXo2e4FLoe3v6aZo27+3v4x6HK:4EnLzu8l4Fj3v6aE3v4Iq
                                                                                                                                                                                                                          MD5:787C83099B6E4E80AC81DD63BA519CBE
                                                                                                                                                                                                                          SHA1:1971ACFAA5753D2914577DCC9EBDF43CF89C1D00
                                                                                                                                                                                                                          SHA-256:BE107F5FAE1E303EA766075C52EF2146EF149EDA37662776E18E93685B176CDC
                                                                                                                                                                                                                          SHA-512:527A36D64B4B5C909F69AA8609CFFEBBA19A378CEA618E1BB07EC2AED89E456E2292080C43917DF51B08534A1D0B35F2069008324C99A7688BBEDE49049CD8A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_PH AM "AM". ::msgcat::mcset en_PH PM "PM". ::msgcat::mcset en_PH DATE_FORMAT "%B %e, %Y". ::msgcat::mcset en_PH TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_PH DATE_TIME_FORMAT "%B %e, %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.865159200607995
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoQW53FD/LoQGuX3v6ZhLoQWa+3v3F0fJ:4EnLzu8283FD/LJ3v6Xc3v3F4
                                                                                                                                                                                                                          MD5:3045036D8F0663E26796E4E8AFF144E2
                                                                                                                                                                                                                          SHA1:6C9066396C107049D861CD0A9C98DE8753782571
                                                                                                                                                                                                                          SHA-256:B8D354519BD4EB1004EB7B25F4E23FD3EE7F533A5F491A46D19FD520ED34C930
                                                                                                                                                                                                                          SHA-512:EBA6CD05BD596D0E8C96BBCA86379F003AD31E564D9CB90C906AF4B3A776AA797FC18EC405781F83493BBB33510DEDC0E78504AD1E6977BE0F83B2959AD25B8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_SG DATE_FORMAT "%d %b %Y". ::msgcat::mcset en_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset en_SG DATE_TIME_FORMAT "%d %b %Y %P %I:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):245
                                                                                                                                                                                                                          Entropy (8bit):4.89152584889677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoOr0l5oOK3v6wLoOs+3v0l6C:4EnLzu8WL3v663vlC
                                                                                                                                                                                                                          MD5:F285A8BA3216DA69B764991124F2F75A
                                                                                                                                                                                                                          SHA1:A5B853A39D944DB9BB1A4C0B9D55AFDEF0515548
                                                                                                                                                                                                                          SHA-256:98CE9CA4BB590BA5F922D6A196E5381E19C64E7682CDBEF914F2DCE6745A7332
                                                                                                                                                                                                                          SHA-512:05695E29BA10072954BC91885A07D74EFBCB81B0DE3961261381210A51968F99CE1801339A05B810A54295E53B0A7E1D75CA5350485A8DEBFFFCBD4945234382
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZA DATE_FORMAT "%Y/%m/%d". ::msgcat::mcset en_ZA TIME_FORMAT_12 "%I:%M:%S". ::msgcat::mcset en_ZA DATE_TIME_FORMAT "%Y/%m/%d %I:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.888960668540414
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoEmGvNLoEs6W3v6aZoEmT+3vR6HK:4EnLzu8urvNDs6W3v6a5J3voq
                                                                                                                                                                                                                          MD5:D8878533B11C21445CAEFA324C638C7E
                                                                                                                                                                                                                          SHA1:EFF82B28741FA16D2DFC93B5421F856D6F902509
                                                                                                                                                                                                                          SHA-256:91088BBBF58A704185DEC13DBD421296BBD271A1AEBBCB3EF85A99CECD848FF8
                                                                                                                                                                                                                          SHA-512:CBFD4FC093B3479AE9E90A5CA05EA1894F62DA9E0559ACC2BD37BBED1F0750ECFF13E6DF2078D68268192CA51A832E1BEED379E11380ADF3C91C1A01A352B20C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset en_ZW DATE_FORMAT "%d %B %Y". ::msgcat::mcset en_ZW TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset en_ZW DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1231
                                                                                                                                                                                                                          Entropy (8bit):4.282246801138565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8CouOZBQpsS9C58mTXv8/s5pkPXvRvm:46nZ6psX8mT/cYpmfFm
                                                                                                                                                                                                                          MD5:FE2F92E5C0AB19CDC7119E70187479F6
                                                                                                                                                                                                                          SHA1:A14B9AA999C0BBD9B21E6A2B44A934D685897430
                                                                                                                                                                                                                          SHA-256:50DF3E0E669502ED08DD778D0AFEDF0F71993BE388B0FCAA1065D1C91BD22D83
                                                                                                                                                                                                                          SHA-512:72B4975DC2CAB725BD6557CAED41B9C9146E0DE167EE0A0723C3C90D7CF49FB1D749977042FFECBCD7D8F21509307AAB3CE80E3C51023D22072FB5B415801EA9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset eo DAYS_OF_WEEK_ABBREV [list \. "di"\. "lu"\. "ma"\. "me"\. "\u0135a"\. "ve"\. "sa"]. ::msgcat::mcset eo DAYS_OF_WEEK_FULL [list \. "diman\u0109o"\. "lundo"\. "mardo"\. "merkredo"\. "\u0135a\u016ddo"\. "vendredo"\. "sabato"]. ::msgcat::mcset eo MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "a\u016dg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset eo MONTHS_FULL [list \. "januaro"\. "februaro"\. "marto"\. "aprilo"\. "majo"\. "junio"\. "julio"\. "a\u016dgusto"\. "septembro"\. "oktobro"\. "novembro"\. "decembro"\. ""]. ::msgcat::mcset eo BCE "aK". ::msgcat::mcset e
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1180
                                                                                                                                                                                                                          Entropy (8bit):4.216657382642579
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8OJccwdQSBJr/S3tFA7C28/sF9AaD5rYrvtAvrG:46w3wdJB1/6FA22c49XrY7tWrG
                                                                                                                                                                                                                          MD5:022CBA4FF73CF18D63D1B0C11D058B5D
                                                                                                                                                                                                                          SHA1:8B2D0BE1BE354D639EC3373FE20A0F255E312EF6
                                                                                                                                                                                                                          SHA-256:FFF2F08A5BE202C81E469E16D4DE1F8A0C1CFE556CDA063DA071279F29314837
                                                                                                                                                                                                                          SHA-512:5142AD14C614E6BA5067B371102F7E81B14EB7AF3E40D05C674CFF1052DA4D172768636D34FF1DEE2499E43B2FEB4771CB1B67EDA10B887DE50E15DCD58A5283
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mi\u00e9"\. "jue"\. "vie"\. "s\u00e1b"]. ::msgcat::mcset es DAYS_OF_WEEK_FULL [list \. "domingo"\. "lunes"\. "martes"\. "mi\u00e9rcoles"\. "jueves"\. "viernes"\. "s\u00e1bado"]. ::msgcat::mcset es MONTHS_ABBREV [list \. "ene"\. "feb"\. "mar"\. "abr"\. "may"\. "jun"\. "jul"\. "ago"\. "sep"\. "oct"\. "nov"\. "dic"\. ""]. ::msgcat::mcset es MONTHS_FULL [list \. "enero"\. "febrero"\. "marzo"\. "abril"\. "mayo"\. "junio"\. "julio"\. "agosto"\. "septiembre"\. "octubre"\. "noviembre"\. "diciembre"\. ""]. ::msgcat::mcset es BCE "a.C.". ::msgcat::mcset es
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):242
                                                                                                                                                                                                                          Entropy (8bit):4.830874390627383
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo8GUFLot/W3vULo8T+3v9y6:4EnLzu8KGUFN3v+K3v3
                                                                                                                                                                                                                          MD5:C806EF01079E6B6B7EAE5D717DA2AAB3
                                                                                                                                                                                                                          SHA1:3C553536241A5D2E95A3BA9024AAB46BB87FBAD9
                                                                                                                                                                                                                          SHA-256:AF530ACD69676678C95B803A29A44642ED2D2F2D077CF0F47B53FF24BAC03B2E
                                                                                                                                                                                                                          SHA-512:619905C2FB5F8D2BC2CBB9F8F0EA117C0AEFBDDE5E4F826FF962D7DC069D16D5DE12E27E898471DC6C039866FB64BBF62ED54DBC031E03C7D24FC2EA38DE5699
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_AR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_AR TIME_FORMAT "%H:%M:%S". ::msgcat::mcset es_AR DATE_TIME_FORMAT "%d/%m/%Y %H:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.878640071219599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoYePWHFLoU3v6rZoY7+3vPUe6HK:4EnLzu8OegFp3v6rHS3vs3q
                                                                                                                                                                                                                          MD5:4C2B2A6FBC6B514EA09AA9EF98834F17
                                                                                                                                                                                                                          SHA1:853FFCBB9A2253B7DC2B82C2BFC3B132500F7A9D
                                                                                                                                                                                                                          SHA-256:24B58DE38CD4CB2ABD08D1EDA6C9454FFDE7ED1A33367B457D7702434A0A55EE
                                                                                                                                                                                                                          SHA-512:3347F9C13896AF19F6BAFBEF225AF2A1F84F20F117E7F0CE3E5CAA783FDD88ABDFAF7C1286AE421BC609A39605E16627013945E4ACA1F7001B066E14CAB90BE7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_BO DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_BO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_BO DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.889615718638578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmodvPWHFLok3v6rZodo+3vPUe6HK:4EnLzu8DgF93v6rC3vs3q
                                                                                                                                                                                                                          MD5:B7E7BE63F24FC1D07F28C5F97637BA1C
                                                                                                                                                                                                                          SHA1:8FE1D17696C910CF59467598233D55268BFE0D94
                                                                                                                                                                                                                          SHA-256:12AD1546EB391989105D80B41A87686D3B30626D0C42A73705F33B2D711950CC
                                                                                                                                                                                                                          SHA-512:FD8B83EF06B1E1111AFF186F5693B17526024CAD8CC99102818BE74FD885344D2F628A0541ABB485F38DB8DE7E29EA4EE4B28D8E5F6ECEF826BABE1013ABDFB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CL DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset es_CL TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CL DATE_TIME_FORMAT "%d-%m-%Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.862231219172699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo4FjbJFLo4F+3v6rZo4++3vjb0f6HK:4EnLzu8QJFL+3v6rv3vbq
                                                                                                                                                                                                                          MD5:FD946BE4D44995911E79135E5B7BD3BB
                                                                                                                                                                                                                          SHA1:3BA38CB03258CA834E37DBB4E3149D4CDA9B353B
                                                                                                                                                                                                                          SHA-256:1B4979874C3F025317DFCF0B06FC8CEE080A28FF3E8EFE1DE9E899F6D4F4D21E
                                                                                                                                                                                                                          SHA-512:FBD8087891BA0AE58D71A6D07482EED5E0EA5C658F0C82A9EC67DFC0D826059F1FC6FF404D6A6DC9619BD9249D4E4EC30D828B177E0939302196C51FA9B2FC4B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CO DATE_FORMAT "%e/%m/%Y". ::msgcat::mcset es_CO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CO DATE_TIME_FORMAT "%e/%m/%Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.873281593259653
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo76GUFLoTW3v6rZo76T+3v9f6HK:4EnLzu8d6GUF73v6rq6K3vMq
                                                                                                                                                                                                                          MD5:F08EF3582AF2F88B71C599FBEA38BFD9
                                                                                                                                                                                                                          SHA1:456C90C09C2A8919DC948E86170F523062F135DB
                                                                                                                                                                                                                          SHA-256:7AC5FC35BC422A5445603E0430236E62CCA3558787811DE22305F72D439EB4BB
                                                                                                                                                                                                                          SHA-512:7187FC4CE0533F14BBA073039A0B86D610618573BA9A936CBE7682ED2939384C6BB9E0A407C016A42702E83627CCE394618ACB58419EA36908AA37F59165E371
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_CR DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset es_CR TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_CR DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.8668686830029335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmomerQZnFLou3v6rZom7+3vrQZg6HK:4EnLzu8xkZFH3v6rM3vkrq
                                                                                                                                                                                                                          MD5:44F2EE567A3E9A021A3C16062CEAE220
                                                                                                                                                                                                                          SHA1:180E938584F0A57AC0C3F85E6574BC48291D820E
                                                                                                                                                                                                                          SHA-256:847C14C297DBE4D8517DEBAA8ED555F3DAEDF843D6BAD1F411598631A0BD3507
                                                                                                                                                                                                                          SHA-512:BEB005D006E432963F9C1EF474A1E3669C8B7AF0681681E74DDA8FE9C8EE04D307EF85CF0257DA72663026138D38807A6ABA1255337CF8CC724ED1993039B40C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset es_DO DATE_FORMAT "%m/%d/%Y". ::msgcat::mcset es_DO TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset es_DO DATE_TIME_FORMAT "%m/%d/%Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.816022066048386
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoZA4HFLoZd3vG5oZd3v6X5oZd+3vnFDoAov:4EnLzu8kyFO3vf3v6f3v9dy
                                                                                                                                                                                                                          MD5:A76D09A4FA15A2C985CA6BDD22989D6A
                                                                                                                                                                                                                          SHA1:E6105EBCDC547FE2E2FE9EDDC9C573BBDAD85AD0
                                                                                                                                                                                                                          SHA-256:7145B57AC5C074BCA968580B337C04A71BBD6EFB93AFAF291C1361FD700DC791
                                                                                                                                                                                                                          SHA-512:D16542A1CCDC3F5C2A20300B7E38F43F94F7753E0E99F08EB7240D4F286B263815AD481B29F4E96F268E24BA17C5E135E356448685E1BF65B2B63CE6146AA54C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fo_FO DATE_FORMAT "%d/%m-%Y". ::msgcat::mcset fo_FO TIME_FORMAT "%T". ::msgcat::mcset fo_FO TIME_FORMAT_12 "%T". ::msgcat::mcset fo_FO DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1205
                                                                                                                                                                                                                          Entropy (8bit):4.313638548211754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8qW09HSZ2p60wTyVz5bGzJzzTK+VUuG4CNnvxvB:46JYY5moleiUb42vlB
                                                                                                                                                                                                                          MD5:B475F8E7D7065A67E73B1E5CDBF9EB1F
                                                                                                                                                                                                                          SHA1:1B689EDC29F8BC4517936E5D77A084083F12AE31
                                                                                                                                                                                                                          SHA-256:7A87E418B6D8D14D8C11D63708B38D607D28F7DDBF39606C7D8FBA22BE7892CA
                                                                                                                                                                                                                          SHA-512:EA77EFF9B23A02F59526499615C08F1314A91AB41561856ED7DF45930FDD8EC11A105218890FD012045C4CC40621C226F94BDC3BEB62B83EA8FAA7AEC20516E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr DAYS_OF_WEEK_ABBREV [list \. "dim."\. "lun."\. "mar."\. "mer."\. "jeu."\. "ven."\. "sam."]. ::msgcat::mcset fr DAYS_OF_WEEK_FULL [list \. "dimanche"\. "lundi"\. "mardi"\. "mercredi"\. "jeudi"\. "vendredi"\. "samedi"]. ::msgcat::mcset fr MONTHS_ABBREV [list \. "janv."\. "f\u00e9vr."\. "mars"\. "avr."\. "mai"\. "juin"\. "juil."\. "ao\u00fbt"\. "sept."\. "oct."\. "nov."\. "d\u00e9c."\. ""]. ::msgcat::mcset fr MONTHS_FULL [list \. "janvier"\. "f\u00e9vrier"\. "mars"\. "avril"\. "mai"\. "juin"\. "juillet"\. "ao\u00fbt"\. "septembre"\. "octobre"\. "novembre"\. "d\u00e9cembre"\. ""]. ::msgcat::mcset fr BCE "a
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.863262857917797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoXqH5oIX3vG5oIX3v6X5og+3vnFDoAov:4EnLzu81qHd3v63v6Y3v9dy
                                                                                                                                                                                                                          MD5:483652B6A3D8010C3CDB6CAD0AD95E72
                                                                                                                                                                                                                          SHA1:8FCDB01D0729E9F1A0CAC56F79EDB79A37734AF5
                                                                                                                                                                                                                          SHA-256:980E703DFB1EEDE7DE48C958F6B501ED4251F69CB0FBCE0FCA85555F5ACF134A
                                                                                                                                                                                                                          SHA-512:0282B8F3884BB4406F69AF2D2F44E431FB8077FEA86D09ED5607BC0932A049853D0C5CAF0B57EF0289F42A8265F76CC4B10111A28B1E0E9BD54E9319B25D8DB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_BE DATE_FORMAT "%d/%m/%y". ::msgcat::mcset fr_BE TIME_FORMAT "%T". ::msgcat::mcset fr_BE TIME_FORMAT_12 "%T". ::msgcat::mcset fr_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.843031408533295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmooI9jo13vG5o13v6X5o1+3vnFDoAov:4EnLzu8eI9Q3vB3v613v9dy
                                                                                                                                                                                                                          MD5:017D816D73DAB852546169F3EC2D16F2
                                                                                                                                                                                                                          SHA1:3145BB54D9E1E4D9166186D5B43F411CE0250594
                                                                                                                                                                                                                          SHA-256:F16E212D5D1F6E83A9FC4E56874E4C7B8F1947EE882610A73199480319EFA529
                                                                                                                                                                                                                          SHA-512:4D4EF395B15F750F16EC64162BE8AB4B082C6CD1877CA63D5EA4A5E940A7F98E46D792115FD105B293DC43714E8662BC4411E14E93F09769A064622E52EDE258
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CA DATE_FORMAT "%Y-%m-%d". ::msgcat::mcset fr_CA TIME_FORMAT "%T". ::msgcat::mcset fr_CA TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CA DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):281
                                                                                                                                                                                                                          Entropy (8bit):4.866549204705568
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoFt2poF+3vG5oF+3v6X5o++3vnFDoAov:4EnLzu8btn+3vB+3v6+3v9dy
                                                                                                                                                                                                                          MD5:8B27EFF0D45F536852E7A819500B7F93
                                                                                                                                                                                                                          SHA1:CAED7D4334BAD8BE586A1AEEE270FB6913A03512
                                                                                                                                                                                                                          SHA-256:AB160BFDEB5C3ADF071E01C78312A81EE4223BBF5470AB880972BBF5965291F3
                                                                                                                                                                                                                          SHA-512:52DD94F524C1D9AB13F5933265691E8C44B2946F507DE30D789FDCFEA7839A4076CB55A01CEB49194134D7BC84E4F490341AAB9DFB75BB960B03829D6550872B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset fr_CH DATE_FORMAT "%d. %m. %y". ::msgcat::mcset fr_CH TIME_FORMAT "%T". ::msgcat::mcset fr_CH TIME_FORMAT_12 "%T". ::msgcat::mcset fr_CH DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1141
                                                                                                                                                                                                                          Entropy (8bit):4.24180563443443
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8qppr5xqPs5Jpwe3zESbs5JpbxK+dfJ:46ct5XGe3zwXu4fJ
                                                                                                                                                                                                                          MD5:88D5CB026EBC3605E8693D9A82C2D050
                                                                                                                                                                                                                          SHA1:C2A613DC7C367A841D99DE15876F5E7A8027BBF8
                                                                                                                                                                                                                          SHA-256:057C75C1AD70653733DCE43EA5BF151500F39314E8B0236EE80F8D5DB623627F
                                                                                                                                                                                                                          SHA-512:253575BFB722CF06937BBE4E9867704B95EFE7B112B370E1430A2027A1818BD2560562A43AD2D067386787899093B25AE84ABFE813672A15A649FEF487E31F7A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga DAYS_OF_WEEK_ABBREV [list \. "Domh"\. "Luan"\. "M\u00e1irt"\. "C\u00e9ad"\. "D\u00e9ar"\. "Aoine"\. "Sath"]. ::msgcat::mcset ga DAYS_OF_WEEK_FULL [list \. "D\u00e9 Domhnaigh"\. "D\u00e9 Luain"\. "D\u00e9 M\u00e1irt"\. "D\u00e9 C\u00e9adaoin"\. "D\u00e9ardaoin"\. "D\u00e9 hAoine"\. "D\u00e9 Sathairn"]. ::msgcat::mcset ga MONTHS_ABBREV [list \. "Ean"\. "Feabh"\. "M\u00e1rta"\. "Aib"\. "Beal"\. "Meith"\. "I\u00fail"\. "L\u00fan"\. "MF\u00f3mh"\. "DF\u00f3mh"\. "Samh"\. "Noll"\. ""]. ::msgcat::mcset ga MONTHS_FULL [list \. "Ean\u00e1ir"\. "Feabhra"\. "M\u00e1rta"\. "Aibre\u00e1n"\. "M\u00ed na Bealtaine"\. "Meith"\. "I\u00fail"\. "L\u00fanasa"
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.7755422576113595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmobHAyg0obHAqo+3vG5obHAqo+3v6X5obHAy9+3vnFDoAov:4EnLzu8s33vj3v6r3v9dy
                                                                                                                                                                                                                          MD5:04452D43DA05A94414973F45CDD12869
                                                                                                                                                                                                                          SHA1:AEEDCC2177B592A0025A1DBCFFC0EF3634DBF562
                                                                                                                                                                                                                          SHA-256:2072E48C98B480DB5677188836485B4605D5A9D99870AC73B5BFE9DCC6DB46F4
                                                                                                                                                                                                                          SHA-512:5A01156FD5AB662EE9D626518B4398A161BAF934E3A618B3A18839A944AEEAEE6FE1A5279D7750511B126DB3AD2CC992CDA067573205ACBC211C34C8A099305F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ga_IE DATE_FORMAT "%d.%m.%y". ::msgcat::mcset ga_IE TIME_FORMAT "%T". ::msgcat::mcset ga_IE TIME_FORMAT_12 "%T". ::msgcat::mcset ga_IE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):950
                                                                                                                                                                                                                          Entropy (8bit):4.037076523160125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8LpP8ihyz/ptFOBViNef9kekIsnyFo0:46J0i0zRtUB0c9dkVneo0
                                                                                                                                                                                                                          MD5:B940E67011DDBAD6192E9182C5F0CCC0
                                                                                                                                                                                                                          SHA1:83A284899785956ECB015BBB871E7E04A7C36585
                                                                                                                                                                                                                          SHA-256:C71A07169CDBE9962616D28F38C32D641DA277E53E67F8E3A69EB320C1E2B88C
                                                                                                                                                                                                                          SHA-512:28570CB14452CA5285D97550EA77C9D8F71C57DE6C1D144ADB00B93712F588AF900DA32C10C3A81C7A2DEE11A3DC843780D24218F53920AB72E90321677CC9E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Lun"\. "Mar"\. "M\u00e9r"\. "Xov"\. "Ven"\. "S\u00e1b"]. ::msgcat::mcset gl DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Luns"\. "Martes"\. "M\u00e9rcores"\. "Xoves"\. "Venres"\. "S\u00e1bado"]. ::msgcat::mcset gl MONTHS_ABBREV [list \. "Xan"\. "Feb"\. "Mar"\. "Abr"\. "Mai"\. "Xu\u00f1"\. "Xul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset gl MONTHS_FULL [list \. "Xaneiro"\. "Febreiro"\. "Marzo"\. "Abril"\. "Maio"\. "Xu\u00f1o"\. "Xullo"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Decembro"\. ""].}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.839318757139709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoPhkgvNLoPxsF3v6aZoPhk9+3vR6HK:4EnLzu8NrvNEK3v6a2J3voq
                                                                                                                                                                                                                          MD5:3FCDF0FC39C8E34F6270A646A996F663
                                                                                                                                                                                                                          SHA1:6999E82148E1D1799C389BCC6C6952D5514F4A4B
                                                                                                                                                                                                                          SHA-256:BC2B0424CF27BEF67F309E2B6DFFEF4D39C46F15D91C15E83E070C7FD4E20C9C
                                                                                                                                                                                                                          SHA-512:CDB9ED694A7E555EB321F559E9B0CC0998FD526ADEF33AD08C56943033351D70900CD6EC62D380E23AB9F65CCFB85F4EEEB4E17FA8CC05E56C2AC57FBEDE721E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gl_ES DATE_FORMAT "%d %B %Y". ::msgcat::mcset gl_ES TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gl_ES DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1037
                                                                                                                                                                                                                          Entropy (8bit):4.13549698574103
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu81WjLHkFQSMnKIeCPHy3CAVfbku5SJ:460jwyLTySI4J
                                                                                                                                                                                                                          MD5:3350E1228CF7157ECE68762F967F2F32
                                                                                                                                                                                                                          SHA1:2D0411DA2F6E0441B1A8683687178E9EB552B835
                                                                                                                                                                                                                          SHA-256:75AA686FF901C9E66E51D36E8E78E5154B57EE9045784568F6A8798EA9689207
                                                                                                                                                                                                                          SHA-512:1D0B44F00A5E6D7B8CECB67EAF060C6053045610CF7246208C8E63E7271C7780587A184D38ECFDFDCFB976F9433FEFDA0BAF8981FCD197554D0874ED1E6B6428
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv DAYS_OF_WEEK_ABBREV [list \. "Jed"\. "Jel"\. "Jem"\. "Jerc"\. "Jerd"\. "Jeh"\. "Jes"]. ::msgcat::mcset gv DAYS_OF_WEEK_FULL [list \. "Jedoonee"\. "Jelhein"\. "Jemayrt"\. "Jercean"\. "Jerdein"\. "Jeheiney"\. "Jesarn"]. ::msgcat::mcset gv MONTHS_ABBREV [list \. "J-guer"\. "T-arree"\. "Mayrnt"\. "Avrril"\. "Boaldyn"\. "M-souree"\. "J-souree"\. "Luanistyn"\. "M-fouyir"\. "J-fouyir"\. "M.Houney"\. "M.Nollick"\. ""]. ::msgcat::mcset gv MONTHS_FULL [list \. "Jerrey-geuree"\. "Toshiaght-arree"\. "Mayrnt"\. "Averil"\. "Boaldyn"\. "Mean-souree"\. "Jerrey-souree"\. "Luanistyn"\. "Mean-fouyir"\. "Jerrey-fouyir"\. "Mee Houney"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.890913756172577
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoQbtvvNLoQLE3v6aZoQbto+3vR6HK:4EnLzu8CbtvvNBLE3v6avbtF3voq
                                                                                                                                                                                                                          MD5:A65040748621B18B1F88072883891280
                                                                                                                                                                                                                          SHA1:4D0ED6668A99BAC9B273B0FA8BC74EB6BB9DDFC8
                                                                                                                                                                                                                          SHA-256:823AF00F4E44613E929D32770EDB214132B6E210E872751624824DA5F0B78448
                                                                                                                                                                                                                          SHA-512:16FFD4107C3B85619629B2CD8A48AB9BC3763FA6E4FE4AE910EDF3B42209CEEB8358D4E7E531C2417875D05E5F801BB19B10130FA8BF70E44CFD8F1BA06F6B6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset gv_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset gv_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset gv_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1938
                                                                                                                                                                                                                          Entropy (8bit):4.234997703698801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8Hdd4CLxLtmCLoCLHCL3CLXLICLP1ptzLzCJCLt5LL53h5Lq+p5LcL3pLzCt:4655ftB9hMcGlhO8/n/0ecOfC3
                                                                                                                                                                                                                          MD5:FFD5D8007D78770EA0E7E5643F1BD20A
                                                                                                                                                                                                                          SHA1:40854EB81EE670086D0D0C0C2F0F9D8406DF6B47
                                                                                                                                                                                                                          SHA-256:D27ADAF74EBB18D6964882CF931260331B93AE4B283427F9A0DB147A83DE1D55
                                                                                                                                                                                                                          SHA-512:EFBDADE1157C7E1CB8458CBA89913FB44DC2399AD860FCAEDA588B99230B0934EDAAF8BAB1742E03F06FA8047D3605E8D63BB23EC4B32155C256D07C46ABBFEE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset he DAYS_OF_WEEK_ABBREV [list \. "\u05d0"\. "\u05d1"\. "\u05d2"\. "\u05d3"\. "\u05d4"\. "\u05d5"\. "\u05e9"]. ::msgcat::mcset he DAYS_OF_WEEK_FULL [list \. "\u05d9\u05d5\u05dd \u05e8\u05d0\u05e9\u05d5\u05df"\. "\u05d9\u05d5\u05dd \u05e9\u05e0\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05dc\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e8\u05d1\u05d9\u05e2\u05d9"\. "\u05d9\u05d5\u05dd \u05d7\u05de\u05d9\u05e9\u05d9"\. "\u05d9\u05d5\u05dd \u05e9\u05d9\u05e9\u05d9"\. "\u05e9\u05d1\u05ea"]. ::msgcat::mcset he MONTHS_ABBREV [list \. "\u05d9\u05e0\u05d5"\. "\u05e4\u05d1\u05e8"\. "\u05de\u05e8\u05e5"\. "\u05d0\u05e4\u05e8"\. "\u05de\u05d0\u05d9"\. "\u05d9\u05d5\u05e0"\. "\u05d9\u05d5\u05dc"\. "\u05d0\u05d5\u05d2"\. "\u05e1\u05e4\u05d8"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1738
                                                                                                                                                                                                                          Entropy (8bit):4.1505681803025185
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8dVYe48VcOVcz1HtDVcqiVca4mGE18VcRBkEVcRfVcRMsVcqiVca4mGE18VI:465v4bNVO7GQbBkDuM4O7GQbBkDuh3x
                                                                                                                                                                                                                          MD5:349823390798DF68270E4DB46C3CA863
                                                                                                                                                                                                                          SHA1:814F9506FCD8B592C22A47023E73457C469B2F53
                                                                                                                                                                                                                          SHA-256:FAFE65DB09BDCB863742FDA8705BCD1C31B59E0DD8A3B347EA6DEC2596CEE0E9
                                                                                                                                                                                                                          SHA-512:4D12213EA9A3EAD6828E21D3B5B73931DC922EBE8FD2373E3A3E106DF1784E0BCE2C9D1FBEAE0D433449BE6D28A0F2F50F49AB8C208E69D413C6787ADF52915E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0932\u0935\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset hi MONTHS_ABBREV [list \. "\u091c\u0928\u0935\u0930\u0940"\. "\u092b\u093c\u0930\u0935\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u0905\u092a\u094d\u0930\u0947\u0932"\. "\u092e\u0908"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u093e\u0908"\. "\u0905\u0917\u0938\u094d\u0924"\. "\u0938\u093f\u0924\u092e\u094d\u092c\u0930"\. "\u0905\u0915\u094d\u091f\u0942\u092c\u0930"\. "\u0928\u0935\u092e\u094d\u092c\u093
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.882853646266983
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmocv+9/Loz3v6rZoco+3v+6f6HK:4EnLzu8+vWq3v6rpF3vmq
                                                                                                                                                                                                                          MD5:BC86C58492BCB8828489B871D2A727F0
                                                                                                                                                                                                                          SHA1:22EEC74FC011063071A40C3860AE8EF38D898582
                                                                                                                                                                                                                          SHA-256:29C7CA358FFFCAF94753C7CC2F63B58386234B75552FA3272C2E36F253770C3F
                                                                                                                                                                                                                          SHA-512:ABFE093952144A285F7A86800F5933F7242CB224D917B4BAA4FD2CA48792BEFCBEE9AB7073472510B53D31083719EC68A77DD896410B3DC3C6E2CCD60C2E92F9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hi_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset hi_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset hi_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1121
                                                                                                                                                                                                                          Entropy (8bit):4.291836444825864
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu84VBVgqoLpYDThoLZDT25KNWg1gqNvEKvOAl:46nNYPSLZP2ZVqJTO+
                                                                                                                                                                                                                          MD5:46FD3DF765F366C60B91FA0C4DE147DE
                                                                                                                                                                                                                          SHA1:5E006D1ACA7BBDAC9B8A65EFB26FAFC03C6E9FDE
                                                                                                                                                                                                                          SHA-256:9E14D8F7F54BE953983F198C8D59F38842C5F73419A5E81BE6460B3623E7307A
                                                                                                                                                                                                                          SHA-512:3AC26C55FB514D9EA46EF57582A2E0B64822E90C889F4B83A62EE255744FEBE0A012079DD764E0F6C7338B3580421C5B6C8575E0B85632015E3689CF58D9EB77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hr DAYS_OF_WEEK_ABBREV [list \. "ned"\. "pon"\. "uto"\. "sri"\. "\u010det"\. "pet"\. "sub"]. ::msgcat::mcset hr DAYS_OF_WEEK_FULL [list \. "nedjelja"\. "ponedjeljak"\. "utorak"\. "srijeda"\. "\u010detvrtak"\. "petak"\. "subota"]. ::msgcat::mcset hr MONTHS_ABBREV [list \. "sij"\. "vel"\. "o\u017eu"\. "tra"\. "svi"\. "lip"\. "srp"\. "kol"\. "ruj"\. "lis"\. "stu"\. "pro"\. ""]. ::msgcat::mcset hr MONTHS_FULL [list \. "sije\u010danj"\. "velja\u010da"\. "o\u017eujak"\. "travanj"\. "svibanj"\. "lipanj"\. "srpanj"\. "kolovoz"\. "rujan"\. "listopad"\. "studeni"\. "prosinac"\. ""]. ::msgcat::mcset hr DATE_FORMAT "
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1327
                                                                                                                                                                                                                          Entropy (8bit):4.447184847972284
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8Xjv5ZemNruwcVNtZHTE9wocxPvt9vq:46fBZemNqwIZHTEE3t5q
                                                                                                                                                                                                                          MD5:0561E62941F6ED8965DFC4E2B424E028
                                                                                                                                                                                                                          SHA1:C622B21C0DBA83F943FBD10C746E5FABE20235B2
                                                                                                                                                                                                                          SHA-256:314F4180C05DE4A4860F65AF6460900FFF77F12C08EDD728F68CA0065126B9AE
                                                                                                                                                                                                                          SHA-512:CAD01C963145463612BBAE4B9F5C80B83B228C0181C2500CE8CE1394E1A32CCA3587221F1406F6343029059F5AD47E8FD5514535DCEA45BBA6B2AE76993DFFBD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset hu DAYS_OF_WEEK_ABBREV [list \. "V"\. "H"\. "K"\. "Sze"\. "Cs"\. "P"\. "Szo"]. ::msgcat::mcset hu DAYS_OF_WEEK_FULL [list \. "vas\u00e1rnap"\. "h\u00e9tf\u0151"\. "kedd"\. "szerda"\. "cs\u00fct\u00f6rt\u00f6k"\. "p\u00e9ntek"\. "szombat"]. ::msgcat::mcset hu MONTHS_ABBREV [list \. "jan."\. "febr."\. "m\u00e1rc."\. "\u00e1pr."\. "m\u00e1j."\. "j\u00fan."\. "j\u00fal."\. "aug."\. "szept."\. "okt."\. "nov."\. "dec."\. ""]. ::msgcat::mcset hu MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "m\u00e1rcius"\. "\u00e1prilis"\. "m\u00e1jus"\. "j\u00fanius"\. "j\u00falius"\. "augusztus"\. "szeptember"\. "okt\u00f3ber"\. "nove
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):914
                                                                                                                                                                                                                          Entropy (8bit):3.9322448438499125
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8acGEXctI9tdb/7579g6tdhUgQbVg:46GBEXKI9tdHtdwg
                                                                                                                                                                                                                          MD5:CE834C7E0C3170B733122FF8BF38C28D
                                                                                                                                                                                                                          SHA1:693ACC2A0972156B984106AFD07911AF14C4F19C
                                                                                                                                                                                                                          SHA-256:1F1B0F5DEDE0263BD81773A78E98AF551F36361ACCB315B618C8AE70A5FE781E
                                                                                                                                                                                                                          SHA-512:23BFC6E2CDB7BA75AAC3AA75869DF4A235E4526E8E83D73551B3BC2CE89F3675EBFA75BC94177F2C2BD6AC58C1B125BE65F8489BC4F85FA701415DB9768F7A80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id DAYS_OF_WEEK_ABBREV [list \. "Min"\. "Sen"\. "Sel"\. "Rab"\. "Kam"\. "Jum"\. "Sab"]. ::msgcat::mcset id DAYS_OF_WEEK_FULL [list \. "Minggu"\. "Senin"\. "Selasa"\. "Rabu"\. "Kamis"\. "Jumat"\. "Sabtu"]. ::msgcat::mcset id MONTHS_ABBREV [list \. "Jan"\. "Peb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Agu"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset id MONTHS_FULL [list \. "Januari"\. "Pebruari"\. "Maret"\. "April"\. "Mei"\. "Juni"\. "Juli"\. "Agustus"\. "September"\. "Oktober"\. "November"\. "Desember"\. ""].}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.857986813915644
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo0kGvNLo0F/W3v6aZo0kT+3vR6HK:4EnLzu8NGvNS3v6aQK3voq
                                                                                                                                                                                                                          MD5:A285817AAABD5203706D5F2A34158C03
                                                                                                                                                                                                                          SHA1:18FD0178051581C9F019604499BF91B16712CC91
                                                                                                                                                                                                                          SHA-256:DB81643BA1FD115E9D547943A889A56DFC0C81B63F21B1EDC1955C6884C1B2F5
                                                                                                                                                                                                                          SHA-512:0B6C684F2E5122681309A6212980C95C14172723F12D4864AF8A8A913DC7081BC42AC39CF087D29770B4A1F0B3B1F712856CBF05D1975FFFC008C16A91081A00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset id_ID DATE_FORMAT "%d %B %Y". ::msgcat::mcset id_ID TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset id_ID DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1255
                                                                                                                                                                                                                          Entropy (8bit):4.391152464169964
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8qVXVDWpXMVmDz1ZVcWVzbQ1/xZ9b3eYXvhv3eT3:462hVW5JDz1ZVUbpfV83
                                                                                                                                                                                                                          MD5:6695839F1C4D2A92552CB1647FD14DA5
                                                                                                                                                                                                                          SHA1:04CB1976846A78EA9593CB3706C9D61173CE030C
                                                                                                                                                                                                                          SHA-256:6767115FFF2DA05F49A28BAD78853FAC6FC716186B985474D6D30764E1727C40
                                                                                                                                                                                                                          SHA-512:208766038A6A1D748F4CB2660F059AD355A5439EA6D8326F4F410B2DFBBDEECB55D4CE230C01C519B08CAB1CF5E5B3AC61E7BA86020A7BDA1AFEA624F3828521
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset is DAYS_OF_WEEK_ABBREV [list \. "sun."\. "m\u00e1n."\. "\u00feri."\. "mi\u00f0."\. "fim."\. "f\u00f6s."\. "lau."]. ::msgcat::mcset is DAYS_OF_WEEK_FULL [list \. "sunnudagur"\. "m\u00e1nudagur"\. "\u00feri\u00f0judagur"\. "mi\u00f0vikudagur"\. "fimmtudagur"\. "f\u00f6studagur"\. "laugardagur"]. ::msgcat::mcset is MONTHS_ABBREV [list \. "jan."\. "feb."\. "mar."\. "apr."\. "ma\u00ed"\. "j\u00fan."\. "j\u00fal."\. "\u00e1g\u00fa."\. "sep."\. "okt."\. "n\u00f3v."\. "des."\. ""]. ::msgcat::mcset is MONTHS_FULL [list \. "jan\u00faar"\. "febr\u00faar"\. "mars"\. "apr\u00edl"\. "ma\u00ed"\. "j\u00fan\u00ed"\. "j\u00fal\u00ed"\. "\u00e1g\u00fast"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1240
                                                                                                                                                                                                                          Entropy (8bit):4.207511774275323
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8iYJcc8jYShjLhQ6I3S68gvNvlNUhsFNlVGvNmv5svc:46Wi38jBJLhQ6I3EgFtNo4NlVGlw5Kc
                                                                                                                                                                                                                          MD5:8E205D032206D794A681E2A994532FA6
                                                                                                                                                                                                                          SHA1:47098672D339624474E8854EB0512D54A0CA49E7
                                                                                                                                                                                                                          SHA-256:C7D84001855586A0BAB236A6A5878922D9C4A2EA1799BF18544869359750C0DF
                                                                                                                                                                                                                          SHA-512:139219DBD014CCA15922C45C7A0468F62E864F18CC16C7B8506258D1ECD766E1EFF6EAE4DFDAF72898B9AF1A5E6CE8D7BB0F1A93A6604D2539F2645C9ED8D146
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it DAYS_OF_WEEK_ABBREV [list \. "dom"\. "lun"\. "mar"\. "mer"\. "gio"\. "ven"\. "sab"]. ::msgcat::mcset it DAYS_OF_WEEK_FULL [list \. "domenica"\. "luned\u00ec"\. "marted\u00ec"\. "mercoled\u00ec"\. "gioved\u00ec"\. "venerd\u00ec"\. "sabato"]. ::msgcat::mcset it MONTHS_ABBREV [list \. "gen"\. "feb"\. "mar"\. "apr"\. "mag"\. "giu"\. "lug"\. "ago"\. "set"\. "ott"\. "nov"\. "dic"\. ""]. ::msgcat::mcset it MONTHS_FULL [list \. "gennaio"\. "febbraio"\. "marzo"\. "aprile"\. "maggio"\. "giugno"\. "luglio"\. "agosto"\. "settembre"\. "ottobre"\. "novembre"\. "dicembre"\. ""]. ::msgcat::mcset it BCE "aC". ::msgc
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):244
                                                                                                                                                                                                                          Entropy (8bit):4.851375233848049
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoi5jLWNLoyJ+3vULoia+3vjLtA6:4EnLzu8m3WNJ+3v23v3t3
                                                                                                                                                                                                                          MD5:8666E24230AED4DC76DB93BE1EA07FF6
                                                                                                                                                                                                                          SHA1:7C688C8693C76AEE07FB32637CD58E47A85760F3
                                                                                                                                                                                                                          SHA-256:2EE356FFA2491A5A60BDF7D7FEBFAC426824904738615A0C1D07AEF6BDA3B76F
                                                                                                                                                                                                                          SHA-512:BCCE87FB94B28B369B9EE48D792A399DB8250D0D3D73FC05D053276A7475229EF1555D5E516D780092496F0E5F229A9912A45FB5A88C024FCEBF08E654D37B07
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset it_CH DATE_FORMAT "%e. %B %Y". ::msgcat::mcset it_CH TIME_FORMAT "%H:%M:%S". ::msgcat::mcset it_CH DATE_TIME_FORMAT "%e. %B %Y %H:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1664
                                                                                                                                                                                                                          Entropy (8bit):4.88149888596689
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8VcQHxbtVLKMwvtFwvQv4fTweLvDvTwS0Zu+jqgv:46RbItt4mCEebzES0njqq
                                                                                                                                                                                                                          MD5:430DEB41034402906156D7E23971CD2C
                                                                                                                                                                                                                          SHA1:0952FFBD241B5111714275F5CD8FB5545067FFEC
                                                                                                                                                                                                                          SHA-256:38DCA9B656241884923C451A369B90A9F1D76F9029B2E98E04784323169C3251
                                                                                                                                                                                                                          SHA-512:AE5DF1B79AE34DF4CC1EB00406FFF49541A95E2C732E3041CCE321F2F3FA6461BB45C6524A5FEB77E18577206CBD88A83FBF20B4B058BAE9B889179C93221557
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ja DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u6708"\. "\u706b"\. "\u6c34"\. "\u6728"\. "\u91d1"\. "\u571f"]. ::msgcat::mcset ja DAYS_OF_WEEK_FULL [list \. "\u65e5\u66dc\u65e5"\. "\u6708\u66dc\u65e5"\. "\u706b\u66dc\u65e5"\. "\u6c34\u66dc\u65e5"\. "\u6728\u66dc\u65e5"\. "\u91d1\u66dc\u65e5"\. "\u571f\u66dc\u65e5"]. ::msgcat::mcset ja MONTHS_FULL [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"]. ::msgcat::mcset ja BCE "\u7d00\u5143\u524d". ::msgcat::mcset ja CE "\u897f\u66a6". ::msgcat::mcset ja AM "\u5348\u524d". ::msgcat::mcset ja PM "\u5348\u5f8c". ::msgcat::mcset ja DATE_FORMAT "%Y/%m/%
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):978
                                                                                                                                                                                                                          Entropy (8bit):4.013253613061898
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu83jGeo9sbjCjS3jCwjLj+zSsS9CfzTA2Qcl:46OOsJzTvl
                                                                                                                                                                                                                          MD5:AE55E001BBE3272CE13369C836139EF3
                                                                                                                                                                                                                          SHA1:D912A0AEBA08BC97D80E9B7A55CE146956C90BCC
                                                                                                                                                                                                                          SHA-256:1B00229DF5A979A040339BBC72D448F39968FEE5CC24F07241C9F6129A9B53DD
                                                                                                                                                                                                                          SHA-512:E53E8DB56AD367E832A121D637CA4755E6C8768C063E4BE43E6193C5F71ED7AA10F7223AC85750C0CAD543CF4A0BFE578CBA2877F176A5E58DCA2BAA2F7177FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl DAYS_OF_WEEK_ABBREV [list \. "sab"\. "ata"\. "mar"\. "pin"\. "sis"\. "tal"\. "arf"]. ::msgcat::mcset kl DAYS_OF_WEEK_FULL [list \. "sabaat"\. "ataasinngorneq"\. "marlunngorneq"\. "pingasunngorneq"\. "sisamanngorneq"\. "tallimanngorneq"\. "arfininngorneq"]. ::msgcat::mcset kl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset kl MONTHS_FULL [list \. "januari"\. "februari"\. "martsi"\. "aprili"\. "maji"\. "juni"\. "juli"\. "augustusi"\. "septemberi"\. "oktoberi"\. "novemberi"\. "decemberi"\. ""].}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.83493357349932
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoEpb53FD/LoEpLE3vG5oEpLE3v6X5oEpba+3vnFDoAov:4EnLzu8KF3FD/1w3vMw3v6T/3v9dy
                                                                                                                                                                                                                          MD5:4B8E5B6EB7C27A02DBC0C766479B068D
                                                                                                                                                                                                                          SHA1:E97A948FFE6C8DE99F91987155DF0A81A630950E
                                                                                                                                                                                                                          SHA-256:F99DA45138A8AEBFD92747FC28992F0C315C6C4AD97710EAF9427263BFFA139C
                                                                                                                                                                                                                          SHA-512:D726494A6F4E1FB8C71B8B56E9B735C1837D8D22828D006EF386E41AD15CD1E4CF14DAC01966B9AFE41F7B6A44916EFC730CF038B4EC393043AE9021D11DACF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kl_GL DATE_FORMAT "%d %b %Y". ::msgcat::mcset kl_GL TIME_FORMAT "%T". ::msgcat::mcset kl_GL TIME_FORMAT_12 "%T". ::msgcat::mcset kl_GL DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1566
                                                                                                                                                                                                                          Entropy (8bit):4.552910804130986
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8cVBfHVnYgY+YGkYeY02Y7YkMXjDHMXjqKKyvtuvFd8vUPvwEq:46ojlmpYEY7XjDsXj+0t4zaU3wt
                                                                                                                                                                                                                          MD5:A4C37AF81FC4AA6003226A95539546C1
                                                                                                                                                                                                                          SHA1:A18A7361783896C691BD5BE8B3A1FCCCCB015F43
                                                                                                                                                                                                                          SHA-256:F6E2B0D116D2C9AC90DDA430B6892371D87A4ECFB6955318978ED6F6E9D546A6
                                                                                                                                                                                                                          SHA-512:FBE6BA258C250BD90FADCC42AC18A17CC4E7B040F160B94075AF1F42ECD43EEA6FE49DA52CF9B5BBB5D965D6AB7C4CC4053A78E865241F891E13F94EB20F0472
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko DAYS_OF_WEEK_ABBREV [list \. "\uc77c"\. "\uc6d4"\. "\ud654"\. "\uc218"\. "\ubaa9"\. "\uae08"\. "\ud1a0"]. ::msgcat::mcset ko DAYS_OF_WEEK_FULL [list \. "\uc77c\uc694\uc77c"\. "\uc6d4\uc694\uc77c"\. "\ud654\uc694\uc77c"\. "\uc218\uc694\uc77c"\. "\ubaa9\uc694\uc77c"\. "\uae08\uc694\uc77c"\. "\ud1a0\uc694\uc77c"]. ::msgcat::mcset ko MONTHS_ABBREV [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\. "9\uc6d4"\. "10\uc6d4"\. "11\uc6d4"\. "12\uc6d4"\. ""]. ::msgcat::mcset ko MONTHS_FULL [list \. "1\uc6d4"\. "2\uc6d4"\. "3\uc6d4"\. "4\uc6d4"\. "5\uc6d4"\. "6\uc6d4"\. "7\uc6d4"\. "8\uc6d4"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):346
                                                                                                                                                                                                                          Entropy (8bit):5.015790750376121
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo56SFZhjNo56m5Ybo56TGMZo56a/W3v6mfvLo56TT+3vOAEP:4EnLzu8r62vjs6m5YS6TGN6a+3v6o66J
                                                                                                                                                                                                                          MD5:9C7E97A55A957AB1D1B5E988AA514724
                                                                                                                                                                                                                          SHA1:592F8FF9FABBC7BF48539AF748DCFC9241AED82D
                                                                                                                                                                                                                          SHA-256:31A4B74F51C584354907251C55FE5CE894D2C9618156A1DC6F5A979BC350DB17
                                                                                                                                                                                                                          SHA-512:9D04DF2A87AFE24C339E1A0F6358FE995CBCAF8C7B08A1A7953675E2C2C1EDBCAF297B23C2B9BEC398DFEE6D1D75CE32E31389A7199466A38BC83C8DBBA67C77
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ko_KR BCE "\uae30\uc6d0\uc804". ::msgcat::mcset ko_KR CE "\uc11c\uae30". ::msgcat::mcset ko_KR DATE_FORMAT "%Y.%m.%d". ::msgcat::mcset ko_KR TIME_FORMAT_12 "%P %l:%M:%S". ::msgcat::mcset ko_KR DATE_TIME_FORMAT "%Y.%m.%d %P %l:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1958
                                                                                                                                                                                                                          Entropy (8bit):4.1451019501109965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8Z448VcOVczWdSVcqVcR0q4vTqBBiXCVcqVcR0q4vTqBBiaMv:46u48h0qpBBaR0qpBBVu
                                                                                                                                                                                                                          MD5:E7938CB3AF53D42B4142CB104AB04B3B
                                                                                                                                                                                                                          SHA1:6205BD2336857F368CABF89647F54D94E093A77B
                                                                                                                                                                                                                          SHA-256:D236D5B27184B1E813E686D901418117F22D67024E6944018FC4B633DF9FF744
                                                                                                                                                                                                                          SHA-512:CE77CE2EC773F3A1A3CD68589C26F7089E8133ADE601CE899EEB0B13648051344A94E69AEC2C8C58349456E52B11EB7545C8926E3F08DB643EE551C641FF38DB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok DAYS_OF_WEEK_FULL [list \. "\u0906\u0926\u093f\u0924\u094d\u092f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u093e\u0930"\. "\u092c\u0941\u0927\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset kok MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):254
                                                                                                                                                                                                                          Entropy (8bit):4.8580653411441155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo5VsNv+9/Lo5VsU3v6rZo5VsNo+3v+6f6HK:4EnLzu8rVsNvWiVsU3v6rAVsNF3vmq
                                                                                                                                                                                                                          MD5:A3B27D44ED430AEC7DF2A47C19659CC4
                                                                                                                                                                                                                          SHA1:700E4B9C395B540BFCE9ABDC81E6B9B758893DC9
                                                                                                                                                                                                                          SHA-256:BEE07F14C7F4FC93B62AC318F89D2ED0DD6FF30D2BF21C2874654FF0292A6C4B
                                                                                                                                                                                                                          SHA-512:79E9D8B817BDB6594A7C95991B2F6D7571D1C2976E74520D28223CF9F05EAA2128A44BC83A94089F09011FFCA9DB5E2D4DD74B59DE2BADC022E1571C595FE36C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kok_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset kok_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset kok_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):966
                                                                                                                                                                                                                          Entropy (8bit):3.9734955453120504
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8z4md0eKwCW44mtls79cp32AqghoPx9ab43gWgw3SeWOdSyECYf5AQZ0eD:4azu806vCmgs7aB2seFkhq+9
                                                                                                                                                                                                                          MD5:413A264B40EEBEB28605481A3405D27D
                                                                                                                                                                                                                          SHA1:9C2EFA6326C62962DCD83BA8D16D89616D2C5B77
                                                                                                                                                                                                                          SHA-256:F49F4E1C7142BF7A82FC2B9FC075171AE45903FE69131478C15219D72BBAAD33
                                                                                                                                                                                                                          SHA-512:CF0559DB130B8070FEC93A64F5317A2C9CDE7D5EAFD1E92E76EAAE0740C6429B7AB7A60BD833CCA4ABCC0AADEBC6A68F854FF654E0707091023D275404172427
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw DAYS_OF_WEEK_ABBREV [list \. "Sul"\. "Lun"\. "Mth"\. "Mhr"\. "Yow"\. "Gwe"\. "Sad"]. ::msgcat::mcset kw DAYS_OF_WEEK_FULL [list \. "De Sul"\. "De Lun"\. "De Merth"\. "De Merher"\. "De Yow"\. "De Gwener"\. "De Sadorn"]. ::msgcat::mcset kw MONTHS_ABBREV [list \. "Gen"\. "Whe"\. "Mer"\. "Ebr"\. "Me"\. "Evn"\. "Gor"\. "Est"\. "Gwn"\. "Hed"\. "Du"\. "Kev"\. ""]. ::msgcat::mcset kw MONTHS_FULL [list \. "Mys Genver"\. "Mys Whevrel"\. "Mys Merth"\. "Mys Ebrel"\. "Mys Me"\. "Mys Evan"\. "Mys Gortheren"\. "Mye Est"\. "Mys Gwyngala"\. "Mys Hedra"\. "Mys Du"\. "Mys Kevardhu"\. ""].}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.914818138642697
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoh6AvvNLoh633v6aZoh6Ao+3vR6HK:4EnLzu8z6AvvN6633v6aY6AF3voq
                                                                                                                                                                                                                          MD5:D325ADCF1F81F40D7B5D9754AE0542F3
                                                                                                                                                                                                                          SHA1:7A6BCD6BE5F41F84B600DF355CB00ECB9B4AE8C0
                                                                                                                                                                                                                          SHA-256:7A8A539C8B990AEFFEA06188B98DC437FD2A6E89FF66483EF334994E73FD0EC9
                                                                                                                                                                                                                          SHA-512:A05BBB3F80784B9C8BBA3FE618FEE154EE40D240ED4CFF7CD6EEE3D97BC4F065EFF585583123F1FFD8ABA1A194EB353229E15ED5CD43759D4D356EC5BE8DCD73
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset kw_GB DATE_FORMAT "%d %B %Y". ::msgcat::mcset kw_GB TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset kw_GB DATE_TIME_FORMAT "%d %B %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1255
                                                                                                                                                                                                                          Entropy (8bit):4.4416408590245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8FHYI4/+HYZoNPW43VvJZb3lSuRnixx/x5JfbiMQeTVYkG2CvRksvQ:46hHNHhu43VxZb3lSuRwxZ5VbiMQeTVL
                                                                                                                                                                                                                          MD5:73F0A9C360A90CB75C6DA7EF87EF512F
                                                                                                                                                                                                                          SHA1:582EB224C9715C8336B4D1FCE7DDEC0D89F5AD71
                                                                                                                                                                                                                          SHA-256:510D8EED3040B50AFAF6A3C85BC98847F1B4D5D8A685C5EC06ACC2491B890101
                                                                                                                                                                                                                          SHA-512:B5482C7448BFC44B05FCF7EB0642B0C7393F4438082A507A94C13F56F12A115A5CE7F0744518BB0B2FAF759D1AD7744B0BEDB98F563C2A4AB11BC4619D7CEA22
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lt DAYS_OF_WEEK_ABBREV [list \. "Sk"\. "Pr"\. "An"\. "Tr"\. "Kt"\. "Pn"\. "\u0160t"]. ::msgcat::mcset lt DAYS_OF_WEEK_FULL [list \. "Sekmadienis"\. "Pirmadienis"\. "Antradienis"\. "Tre\u010diadienis"\. "Ketvirtadienis"\. "Penktadienis"\. "\u0160e\u0161tadienis"]. ::msgcat::mcset lt MONTHS_ABBREV [list \. "Sau"\. "Vas"\. "Kov"\. "Bal"\. "Geg"\. "Bir"\. "Lie"\. "Rgp"\. "Rgs"\. "Spa"\. "Lap"\. "Grd"\. ""]. ::msgcat::mcset lt MONTHS_FULL [list \. "Sausio"\. "Vasario"\. "Kovo"\. "Baland\u017eio"\. "Gegu\u017e\u0117s"\. "Bir\u017eelio"\. "Liepos"\. "Rugpj\u016b\u010dio"\. "Rugs\u0117jo"\. "Spalio"\. "Lapkri\u010dio"\. "G
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1219
                                                                                                                                                                                                                          Entropy (8bit):4.39393801727056
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8lmZG0me3AEcGo49bJcpF9gT9PCbF5uld0vVcASAr8svJ5vk3:46TGAE8Q/PG5dv//Lk3
                                                                                                                                                                                                                          MD5:D5DEB8EFFE6298858F9D1B9FAD0EA525
                                                                                                                                                                                                                          SHA1:973DF40D0464BCE10EB5991806D9990B65AB0F82
                                                                                                                                                                                                                          SHA-256:FD95B38A3BEBD59468BDC2890BAC59DF31C352E17F2E77C82471E1CA89469802
                                                                                                                                                                                                                          SHA-512:F024E3D6D30E8E5C3316364A905C8CCAC87427BFC2EC10E72065F1DD114A112A61FDECDF1C4EC9C3D8BB9A54D18ED4AE9D57B07DA4AFFE480DE12F3D54BED928
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset lv DAYS_OF_WEEK_ABBREV [list \. "Sv"\. "P"\. "O"\. "T"\. "C"\. "Pk"\. "S"]. ::msgcat::mcset lv DAYS_OF_WEEK_FULL [list \. "sv\u0113tdiena"\. "pirmdiena"\. "otrdiena"\. "tre\u0161diena"\. "ceturdien"\. "piektdiena"\. "sestdiena"]. ::msgcat::mcset lv MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maijs"\. "J\u016bn"\. "J\u016bl"\. "Aug"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset lv MONTHS_FULL [list \. "janv\u0101ris"\. "febru\u0101ris"\. "marts"\. "apr\u012blis"\. "maijs"\. "j\u016bnijs"\. "j\u016blijs"\. "augusts"\. "septembris"\. "oktobris"\. "novembris"\. "decembris"\. ""]. ::msgcat
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2105
                                                                                                                                                                                                                          Entropy (8bit):4.237536682442766
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46UcQdZnlcQfAQPWQEHKr9nGUeDjDpxpWQ1Q3QuQoQLX9TSQ2QIQPQHp7+8i:hNdR7cr9nMvXI0i7F89TSn1KX
                                                                                                                                                                                                                          MD5:CD589758D4F4B522781A10003D3E1791
                                                                                                                                                                                                                          SHA1:D953DD123D54B02BAF4B1AE0D36081CDFCA38444
                                                                                                                                                                                                                          SHA-256:F384DD88523147CEF42AA871D323FC4CBEE338FF67CC5C95AEC7940C0E531AE3
                                                                                                                                                                                                                          SHA-512:2EA1E71CD1E958F83277006343E85513D112CBB3C22CBFF29910CB1FC37F2389B3F1DCB2533EC59F9E642624869E5C61F289FDC010B55C6EECEF378F2D92DB0B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0435\u0434."\. "\u043f\u043e\u043d."\. "\u0432\u0442."\. "\u0441\u0440\u0435."\. "\u0447\u0435\u0442."\. "\u043f\u0435\u0442."\. "\u0441\u0430\u0431."]. ::msgcat::mcset mk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0435\u043b\u0430"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0440\u0442\u043e\u043a"\. "\u043f\u0435\u0442\u043e\u043a"\. "\u0441\u0430\u0431\u043e\u0442\u0430"]. ::msgcat::mcset mk MONTHS_ABBREV [list \. "\u0458\u0430\u043d."\. "\u0444\u0435\u0432."\. "\u043c\u0430\u0440."\. "\u0430\u043f\u0440."\. "\u043c\u0430\u0458."\. "\u0458\u0443\u043d."\. "\u0458\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1807
                                                                                                                                                                                                                          Entropy (8bit):4.160320823510059
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8ocYe48VcOVczyVczoRSVcqVcR0q4vTqBBiPNVcqVcR0q4vTqBBil:46R48h0qpBBkI0qpBBe
                                                                                                                                                                                                                          MD5:791408BAE710B77A27AD664EC3325E1C
                                                                                                                                                                                                                          SHA1:E760B143A854838E18FFB66500F4D312DD80634E
                                                                                                                                                                                                                          SHA-256:EB2E2B7A41854AF68CEF5881CF1FBF4D38E70D2FAB2C3F3CE5901AA5CC56FC15
                                                                                                                                                                                                                          SHA-512:FE91EF67AB9313909FE0C29D5FBE2298EE35969A26A63D94A406BFDA7BCF932F2211F94C0E3C1D718DBC2D1145283C768C23487EEB253249ACFE76E8D1F1D1E5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr DAYS_OF_WEEK_FULL [list \. "\u0930\u0935\u093f\u0935\u093e\u0930"\. "\u0938\u094b\u092e\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u092e\u0902\u0917\u0933\u0935\u093e\u0930"\. "\u0917\u0941\u0930\u0941\u0935\u093e\u0930"\. "\u0936\u0941\u0915\u094d\u0930\u0935\u093e\u0930"\. "\u0936\u0928\u093f\u0935\u093e\u0930"]. ::msgcat::mcset mr MONTHS_ABBREV [list \. "\u091c\u093e\u0928\u0947\u0935\u093e\u0930\u0940"\. "\u092b\u0947\u092c\u0943\u0935\u093e\u0930\u0940"\. "\u092e\u093e\u0930\u094d\u091a"\. "\u090f\u092a\u094d\u0930\u093f\u0932"\. "\u092e\u0947"\. "\u091c\u0942\u0928"\. "\u091c\u0941\u0932\u0948"\. "\u0913\u0917\u0938\u094d\u091f"\. "\u0938\u0947\u092a\u094d\u091f\u0947\u0902\u092c\u0930"\. "\u0913\u0915\u094d\u091f\u094b\u092c\u0930"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.847742455062573
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoGNv+9/LoGU3v6rZoGNo+3v+6f6HK:4EnLzu8GvWe3v6r5F3vmq
                                                                                                                                                                                                                          MD5:899E845D33CAAFB6AD3B1F24B3F92843
                                                                                                                                                                                                                          SHA1:FC17A6742BF87E81BBD4D5CB7B4DCED0D4DD657B
                                                                                                                                                                                                                          SHA-256:F75A29BB323DB4354B0C759CB1C8C5A4FFC376DFFD74274CA60A36994816A75C
                                                                                                                                                                                                                          SHA-512:99D05FCE8A9C9BE06FDA8B54D4DE5497141F6373F470B2AB24C2D00B9C56031350F5DCDA2283A0E6F5B09FF21218FC3C7E2A6AB8ECC5BB020546FD62BDC8FF99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mr_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset mr_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset mr_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):910
                                                                                                                                                                                                                          Entropy (8bit):3.9292866027924838
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu82mCBuvFYcEfmt1qWjefjESRsToOqrlHvFguSixTRs1OAfC67:4azu82nBuHEfKxjeby7cl9gbZUAfCc
                                                                                                                                                                                                                          MD5:441CC737D383D8213F64B62A5DBEEC3E
                                                                                                                                                                                                                          SHA1:34FBE99FB25A0DCA2FDA2C008AC8127BA2BC273B
                                                                                                                                                                                                                          SHA-256:831F611EE851A64BF1BA5F9A5441EC1D50722FA9F15B4227707FE1927F754DE4
                                                                                                                                                                                                                          SHA-512:0474B2127890F63814CD9E77D156B5E4FC45EB3C17A57719B672AC9E3A6EEA9934F0BE158F76808B34A11DA844AB900652C18E512830278DFED2666CD005FBE5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms DAYS_OF_WEEK_ABBREV [list \. "Aha"\. "Isn"\. "Sei"\. "Rab"\. "Kha"\. "Jum"\. "Sab"]. ::msgcat::mcset ms DAYS_OF_WEEK_FULL [list \. "Ahad"\. "Isnin"\. "Selasa"\. "Rahu"\. "Khamis"\. "Jumaat"\. "Sabtu"]. ::msgcat::mcset ms MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mac"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ogos"\. "Sep"\. "Okt"\. "Nov"\. "Dis"\. ""]. ::msgcat::mcset ms MONTHS_FULL [list \. "Januari"\. "Februari"\. "Mac"\. "April"\. "Mei"\. "Jun"\. "Julai"\. "Ogos"\. "September"\. "Oktober"\. "November"\. "Disember"\. ""].}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):259
                                                                                                                                                                                                                          Entropy (8bit):4.770028367699931
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoChFflD/LoChF+3v6xH5oCh++3vflm6PYv:4EnLzu8IPflD/ne3v6Tl3vflm6q
                                                                                                                                                                                                                          MD5:8261689A45FB754158B10B044BDC4965
                                                                                                                                                                                                                          SHA1:6FFC9B16A0600D9BC457322F1316BC175309C6CA
                                                                                                                                                                                                                          SHA-256:D05948D75C06669ADDB9708BC5FB48E6B651D4E62EF1B327EF8A3F605FD5271C
                                                                                                                                                                                                                          SHA-512:0321A5C17B3E33FDE9480AC6014B373D1663219D0069388920D277AA61341B8293883517C900030177FF82D65340E6C9E3ED051B27708DD093055E3BE64B2AF3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ms_MY DATE_FORMAT "%A %d %b %Y". ::msgcat::mcset ms_MY TIME_FORMAT_12 "%I:%M:%S %z". ::msgcat::mcset ms_MY DATE_TIME_FORMAT "%A %d %b %Y %I:%M:%S %z %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):690
                                                                                                                                                                                                                          Entropy (8bit):4.48913642143724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8+YmWjjRgWfjxBTo4erxy1IGZzNN+3v6amK3vZsq:4azu8+YZjjRXbfNedy1IG5N6vjmsvGq
                                                                                                                                                                                                                          MD5:CE7E67A03ED8C3297C6A5B634B55D144
                                                                                                                                                                                                                          SHA1:3DA5ACC0F52518541810E7F2FE57751955E12BDA
                                                                                                                                                                                                                          SHA-256:D115718818E3E3367847CE35BB5FF0361D08993D9749D438C918F8EB87AD8814
                                                                                                                                                                                                                          SHA-512:3754AA7B7D27A813C6113D2AA834A951FED1B81E4DACE22C81E0583F29BBC73C014697F39A2067DEC622D98EACD70D26FD40F80CF6D09E1C949F01FADED52C74
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset mt DAYS_OF_WEEK_ABBREV [list \. "\u0126ad"\. "Tne"\. "Tli"\. "Erb"\. "\u0126am"\. "\u0120im"]. ::msgcat::mcset mt MONTHS_ABBREV [list \. "Jan"\. "Fra"\. "Mar"\. "Apr"\. "Mej"\. "\u0120un"\. "Lul"\. "Awi"\. "Set"\. "Ott"\. "Nov"]. ::msgcat::mcset mt BCE "QK". ::msgcat::mcset mt CE "". ::msgcat::mcset mt DATE_FORMAT "%A, %e ta %B, %Y". ::msgcat::mcset mt TIME_FORMAT_12 "%l:%M:%S %P". ::msgcat::mcset mt DATE_TIME_FORMAT "%A, %e ta %B, %Y %l:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1157
                                                                                                                                                                                                                          Entropy (8bit):4.24006506188001
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8CKEj4/xasSpfiTBtHQT1V/W3WNfvZv3l:46KU/0s2iTeVOiHN1
                                                                                                                                                                                                                          MD5:D5509ABF5CBFB485C20A26FCC6B1783E
                                                                                                                                                                                                                          SHA1:53A298FBBF09AE2E223B041786443A3D8688C9EB
                                                                                                                                                                                                                          SHA-256:BC401889DD934C49D10D99B471441BE2B536B1722739C7B0AB7DE7629680F602
                                                                                                                                                                                                                          SHA-512:BDAFBA46EF44151CFD9EF7BC1909210F6DB2BAC20C31ED21AE3BE7EAC785CD4F545C4590CF551C0D066F982E2050F5844BDDC569F32C5804DBDE657F4511A6FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nb DAYS_OF_WEEK_ABBREV [list \. "s\u00f8"\. "ma"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f8"]. ::msgcat::mcset nb DAYS_OF_WEEK_FULL [list \. "s\u00f8ndag"\. "mandag"\. "tirsdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f8rdag"]. ::msgcat::mcset nb MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nb MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nb BCE "f.Kr.". ::msgcat::mcset nb CE "e.Kr.".
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1079
                                                                                                                                                                                                                          Entropy (8bit):4.158523842311663
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu84LFiS8LMKZoNfSZTNTQhFCNZvtWvg:46Oi5LMKZASZTEF2Ntgg
                                                                                                                                                                                                                          MD5:98820DFF7E1C8A9EAB8C74B0B25DEB5D
                                                                                                                                                                                                                          SHA1:5357063D5699188E544D244EC4AEFDDF7606B922
                                                                                                                                                                                                                          SHA-256:49128B36B88E380188059C4B593C317382F32E29D1ADC18D58D14D142459A2BB
                                                                                                                                                                                                                          SHA-512:26AB945B7BA00433BEC85ACC1D90D1D3B70CE505976CABE1D75A7134E00CD591AC27463987C515EEA079969DBCF200DA9C8538CAAF178A1EE17C9B0284260C45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl DAYS_OF_WEEK_ABBREV [list \. "zo"\. "ma"\. "di"\. "wo"\. "do"\. "vr"\. "za"]. ::msgcat::mcset nl DAYS_OF_WEEK_FULL [list \. "zondag"\. "maandag"\. "dinsdag"\. "woensdag"\. "donderdag"\. "vrijdag"\. "zaterdag"]. ::msgcat::mcset nl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mrt"\. "apr"\. "mei"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset nl MONTHS_FULL [list \. "januari"\. "februari"\. "maart"\. "april"\. "mei"\. "juni"\. "juli"\. "augustus"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset nl DATE_FORMAT "%e %B %Y". ::msgcat::mcset nl TIME_FORM
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.817188474504631
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmo4gPI5og9X3vG5og9X3v6X5o49+3vnFDoAov:4EnLzu8WgAhF3v8F3v6JI3v9dy
                                                                                                                                                                                                                          MD5:B08E30850CA849068D06A99B4E216892
                                                                                                                                                                                                                          SHA1:11B5E95FF4D822E76A1B9C28EEC2BC5E95E5E362
                                                                                                                                                                                                                          SHA-256:9CD54EC24CBDBEC5E4FE543DDA8CA95390678D432D33201FA1C32B61F8FE225A
                                                                                                                                                                                                                          SHA-512:9AF147C2F22B11115E32E0BFD0126FE7668328E7C67B349A781F42B0022A334E53DDF3FCCC2C34C91BFBB45602A002D0D7B569B5E1FE9F0EE6C4570400CB0B0C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nl_BE DATE_FORMAT "%d-%m-%y". ::msgcat::mcset nl_BE TIME_FORMAT "%T". ::msgcat::mcset nl_BE TIME_FORMAT_12 "%T". ::msgcat::mcset nl_BE DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1148
                                                                                                                                                                                                                          Entropy (8bit):4.207752506572597
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8eNsP2/xhsSpf2TBtHQT15j63WN7v9v3l:46it/vs22Te5OiL51
                                                                                                                                                                                                                          MD5:2266607EF358B632696C7164E61358B5
                                                                                                                                                                                                                          SHA1:A380863A8320DAB1D5A2D60C22ED5F7DB5C7BAF7
                                                                                                                                                                                                                          SHA-256:5EE93A8C245722DEB64B68EFF50C081F24DA5DE43D999C006A10C484E1D3B4ED
                                                                                                                                                                                                                          SHA-512:2A8DEF754A25736D14B958D8B0CEA0DC41C402A9EFA25C9500BA861A7E8D74C79939C1969AC694245605C17D33AD3984F6B9ACCA4BE03EFC41A878772BB5FD86
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset nn DAYS_OF_WEEK_ABBREV [list \. "su"\. "m\u00e5"\. "ty"\. "on"\. "to"\. "fr"\. "lau"]. ::msgcat::mcset nn DAYS_OF_WEEK_FULL [list \. "sundag"\. "m\u00e5ndag"\. "tysdag"\. "onsdag"\. "torsdag"\. "fredag"\. "laurdag"]. ::msgcat::mcset nn MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "mai"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "des"\. ""]. ::msgcat::mcset nn MONTHS_FULL [list \. "januar"\. "februar"\. "mars"\. "april"\. "mai"\. "juni"\. "juli"\. "august"\. "september"\. "oktober"\. "november"\. "desember"\. ""]. ::msgcat::mcset nn BCE "f.Kr.". ::msgcat::mcset nn CE "e.Kr.". ::msgca
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1211
                                                                                                                                                                                                                          Entropy (8bit):4.392723231340452
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu854moKR4mtPoTckd8EnO6z3K4jwxI1LRhtm3ni8FwxIBgdE4RsMZmB0CLs:4azu8yNgyJxPEyRhonO+AjTg0Okvpvn
                                                                                                                                                                                                                          MD5:31A9133E9DCA7751B4C3451D60CCFFA0
                                                                                                                                                                                                                          SHA1:FB97A5830965716E77563BE6B7EB1C6A0EA6BF40
                                                                                                                                                                                                                          SHA-256:C39595DDC0095EB4AE9E66DB02EE175B31AC3DA1F649EB88FA61B911F838F753
                                                                                                                                                                                                                          SHA-512:329EE7FE79783C83361A0C5FFFD7766B64B8544D1AD63C57AEAA2CC6A526E01D9C4D7765C73E88F86DAE57477459EA330A0C42F39E441B50DE9B0F429D01EAE8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pl DAYS_OF_WEEK_ABBREV [list \. "N"\. "Pn"\. "Wt"\. "\u015ar"\. "Cz"\. "Pt"\. "So"]. ::msgcat::mcset pl DAYS_OF_WEEK_FULL [list \. "niedziela"\. "poniedzia\u0142ek"\. "wtorek"\. "\u015broda"\. "czwartek"\. "pi\u0105tek"\. "sobota"]. ::msgcat::mcset pl MONTHS_ABBREV [list \. "sty"\. "lut"\. "mar"\. "kwi"\. "maj"\. "cze"\. "lip"\. "sie"\. "wrz"\. "pa\u017a"\. "lis"\. "gru"\. ""]. ::msgcat::mcset pl MONTHS_FULL [list \. "stycze\u0144"\. "luty"\. "marzec"\. "kwiecie\u0144"\. "maj"\. "czerwiec"\. "lipiec"\. "sierpie\u0144"\. "wrzesie\u0144"\. "pa\u017adziernik"\. "listopad"\. "grudzie\u0144"\. ""]. ::msgcat::m
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1127
                                                                                                                                                                                                                          Entropy (8bit):4.325163993882846
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8pYpzzktTYyUgC0CIKjblie5f9kwAAs+CFsFoD6GADvtU6svO:46dCzWTh2AA9/2F4oD6GAztU6KO
                                                                                                                                                                                                                          MD5:D827F76D1ED6CB89839CAC2B56FD7252
                                                                                                                                                                                                                          SHA1:140D6BC1F6CEF5FD0A390B3842053BF54B54B4E2
                                                                                                                                                                                                                          SHA-256:9F2BFFA3B4D8783B2CFB2CED9CC4319ACF06988F61829A1E5291D55B19854E88
                                                                                                                                                                                                                          SHA-512:B662336699E23E371F0148EDD742F71874A7A28DFA81F0AFAE91C8C9494CEA1904FEA0C21264CF2A253E0FB1360AD35B28CFC4B74E4D7B2DBB0E453E96F7EB93
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt DAYS_OF_WEEK_ABBREV [list \. "Dom"\. "Seg"\. "Ter"\. "Qua"\. "Qui"\. "Sex"\. "S\u00e1b"]. ::msgcat::mcset pt DAYS_OF_WEEK_FULL [list \. "Domingo"\. "Segunda-feira"\. "Ter\u00e7a-feira"\. "Quarta-feira"\. "Quinta-feira"\. "Sexta-feira"\. "S\u00e1bado"]. ::msgcat::mcset pt MONTHS_ABBREV [list \. "Jan"\. "Fev"\. "Mar"\. "Abr"\. "Mai"\. "Jun"\. "Jul"\. "Ago"\. "Set"\. "Out"\. "Nov"\. "Dez"\. ""]. ::msgcat::mcset pt MONTHS_FULL [list \. "Janeiro"\. "Fevereiro"\. "Mar\u00e7o"\. "Abril"\. "Maio"\. "Junho"\. "Julho"\. "Agosto"\. "Setembro"\. "Outubro"\. "Novembro"\. "Dezembro"\. ""]. ::msgcat::mcset pt DATE_FO
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):279
                                                                                                                                                                                                                          Entropy (8bit):4.8127929329126085
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmofm6GPWHFLofAW3vG5ofAW3v6X5ofm6T+3vnFDoAov:4EnLzu8hNGgF493vr93v6uNK3v9dy
                                                                                                                                                                                                                          MD5:4EE34960147173A12020A583340E92F8
                                                                                                                                                                                                                          SHA1:78D91A80E2426A84BC88EE97DA28EC0E4BE8DE45
                                                                                                                                                                                                                          SHA-256:E383B20484EE90C00054D52DD5AF473B2AC9DC50C14D459A579EF5F44271D256
                                                                                                                                                                                                                          SHA-512:EDFF8FB9A86731FFF005AFBBBB522F69B2C6033F59ECCD5E35A8B6A9E0F9AF23C52FFDCC22D893915AD1854E8104C81DA8C5BD8C794C7E645AFB82001B4BFC24
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset pt_BR DATE_FORMAT "%d-%m-%Y". ::msgcat::mcset pt_BR TIME_FORMAT "%T". ::msgcat::mcset pt_BR TIME_FORMAT_12 "%T". ::msgcat::mcset pt_BR DATE_TIME_FORMAT "%a %d %b %Y %T %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1172
                                                                                                                                                                                                                          Entropy (8bit):4.279005910896047
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8/0oFUBZNk1Mkp3pFukZEoVYfPcF+T1vWFMvUvWI3:46kNkKkpLEoSfPcFgvWFqSWI3
                                                                                                                                                                                                                          MD5:0F5C8A7022DB1203442241ABEB5901FF
                                                                                                                                                                                                                          SHA1:C54C8BF05E8E6C2C0901D3C88C89DDCF35A26924
                                                                                                                                                                                                                          SHA-256:D2E14BE188350D343927D5380EB5672039FE9A37E9A9957921B40E4619B36027
                                                                                                                                                                                                                          SHA-512:13ACF499FA803D4446D8EC67119BC8257B1F093084B83D854643CEA918049F96C8FA08DC5F896EECA80A5FD552D90E5079937B1A3894D89A589E468172856163
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ro DAYS_OF_WEEK_ABBREV [list \. "D"\. "L"\. "Ma"\. "Mi"\. "J"\. "V"\. "S"]. ::msgcat::mcset ro DAYS_OF_WEEK_FULL [list \. "duminic\u0103"\. "luni"\. "mar\u0163i"\. "miercuri"\. "joi"\. "vineri"\. "s\u00eemb\u0103t\u0103"]. ::msgcat::mcset ro MONTHS_ABBREV [list \. "Ian"\. "Feb"\. "Mar"\. "Apr"\. "Mai"\. "Iun"\. "Iul"\. "Aug"\. "Sep"\. "Oct"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset ro MONTHS_FULL [list \. "ianuarie"\. "februarie"\. "martie"\. "aprilie"\. "mai"\. "iunie"\. "iulie"\. "august"\. "septembrie"\. "octombrie"\. "noiembrie"\. "decembrie"\. ""]. ::msgcat::mcset ro BCE "d.C.". ::msgcat::mcset ro CE
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2039
                                                                                                                                                                                                                          Entropy (8bit):4.225775794669275
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46CpQ7kvicQfAQPlQoBBCZAitBmZ/QhQoQaQPTeQgQonQ4FQEWFkt3Wd:hCpgkvzRo6QBw53weFHXFgIGd
                                                                                                                                                                                                                          MD5:3A7181CE08259FF19D2C27CF8C6752B3
                                                                                                                                                                                                                          SHA1:97DFFB1E224CEDB5427841C3B59F85376CD4423B
                                                                                                                                                                                                                          SHA-256:C2A3A0BE5BC5A46A6A63C4DE34E317B402BAD40C22FB2936E1A4F53C1E2F625F
                                                                                                                                                                                                                          SHA-512:CC9620BA4601E53B22CCFC66A0B53C26224158379DF6BA2D4704A2FE11222DFBDAE3CA9CF51576B4084B8CCA8DB13FDE81396E38F94BCD0C8EA21C5D77680394
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru DAYS_OF_WEEK_ABBREV [list \. "\u0412\u0441"\. "\u041f\u043d"\. "\u0412\u0442"\. "\u0421\u0440"\. "\u0427\u0442"\. "\u041f\u0442"\. "\u0421\u0431"]. ::msgcat::mcset ru DAYS_OF_WEEK_FULL [list \. "\u0432\u043e\u0441\u043a\u0440\u0435\u0441\u0435\u043d\u044c\u0435"\. "\u043f\u043e\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u0438\u043a"\. "\u0432\u0442\u043e\u0440\u043d\u0438\u043a"\. "\u0441\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440\u0433"\. "\u043f\u044f\u0442\u043d\u0438\u0446\u0430"\. "\u0441\u0443\u0431\u0431\u043e\u0442\u0430"]. ::msgcat::mcset ru MONTHS_ABBREV [list \. "\u044f\u043d\u0432"\. "\u0444\u0435\u0432"\. "\u043c\u0430\u0440"\. "\u0430\u043f\u0440"\. "\u043c\u0430\u0439"\. "\u0438\u044e\u043d"\. "\u0438\u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):242
                                                                                                                                                                                                                          Entropy (8bit):4.8961185447535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoVAgWFLoVY9X3vtfNrFLoVA9+3vW6Q9:4EnLzu8DFWFgaX3vtNS/3vWH9
                                                                                                                                                                                                                          MD5:E719F47462123A8E7DABADD2D362B4D8
                                                                                                                                                                                                                          SHA1:332E4CC96E7A01DA7FB399EA14770A5C5185B9F2
                                                                                                                                                                                                                          SHA-256:AE5D3DF23F019455F3EDFC3262AAC2B00098881F09B9A934C0D26C0AB896700C
                                                                                                                                                                                                                          SHA-512:93C19D51B633A118AB0D172C5A0991E5084BD54B2E61469D800F80B251A57BD1392BA66FD627586E75B1B075A7C9C2C667654F5783C423819FBDEA640A210BFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ru_UA DATE_FORMAT "%d.%m.%Y". ::msgcat::mcset ru_UA TIME_FORMAT "%k:%M:%S". ::msgcat::mcset ru_UA DATE_TIME_FORMAT "%d.%m.%Y %k:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1160
                                                                                                                                                                                                                          Entropy (8bit):4.287536872407747
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8YYy/FY+Cnwj4EbJK5O9g+tQhgQmy/L6GWGvtlMsvWT9:46al4ETw/rWQtVWh
                                                                                                                                                                                                                          MD5:C7BBD44BD3C30C6116A15C77B15F8E79
                                                                                                                                                                                                                          SHA1:37CD1477A3318838E8D5C93D596A23F99C8409F2
                                                                                                                                                                                                                          SHA-256:00F119701C9F3EBA273701A6A731ADAFD7B8902F6BCCF34E61308984456E193A
                                                                                                                                                                                                                          SHA-512:DAFBDA53CF6AD57A4F6A078E9EF8ED3CACF2F8809DC2AEFB812A4C3ACCD51D954C52079FA26828D670BF696E14989D3FE3C249F1E612B7C759770378919D8BBC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sh DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Uto"\. "Sre"\. "\u010cet"\. "Pet"\. "Sub"]. ::msgcat::mcset sh DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljak"\. "Utorak"\. "Sreda"\. "\u010cetvrtak"\. "Petak"\. "Subota"]. ::msgcat::mcset sh MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Maj"\. "Jun"\. "Jul"\. "Avg"\. "Sep"\. "Okt"\. "Nov"\. "Dec"\. ""]. ::msgcat::mcset sh MONTHS_FULL [list \. "Januar"\. "Februar"\. "Mart"\. "April"\. "Maj"\. "Juni"\. "Juli"\. "Avgust"\. "Septembar"\. "Oktobar"\. "Novembar"\. "Decembar"\. ""]. ::msgcat::mcset sh BCE "p. n. e.". ::msgcat::mcset sh CE "n. e."
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1203
                                                                                                                                                                                                                          Entropy (8bit):4.335103779497533
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu834j4PV3sSAT3fk3TEJbAT3T1cPyF3eYuCvte/v3eG:46TUG3sPk3TEkcPyFpuEtenJ
                                                                                                                                                                                                                          MD5:B2EF88014D274C8001B36739F5F566CE
                                                                                                                                                                                                                          SHA1:1044145C1714FD44D008B13A31BC778DFBE47950
                                                                                                                                                                                                                          SHA-256:043DECE6EA7C83956B3300B95F8A0E92BADAA8FC29D6C510706649D1D810679A
                                                                                                                                                                                                                          SHA-512:820EB42D94BEE21FDB990FC27F7900CF676AFC59520F3EE78FB72D6D7243A17A234D4AE964E5D52AD7CBC7DD9A593F672BAD8A80EC48B25B344AA6950EF52ECF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sk DAYS_OF_WEEK_ABBREV [list \. "Ne"\. "Po"\. "Ut"\. "St"\. "\u0160t"\. "Pa"\. "So"]. ::msgcat::mcset sk DAYS_OF_WEEK_FULL [list \. "Nede\u013ee"\. "Pondelok"\. "Utorok"\. "Streda"\. "\u0160tvrtok"\. "Piatok"\. "Sobota"]. ::msgcat::mcset sk MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sk MONTHS_FULL [list \. "janu\u00e1r"\. "febru\u00e1r"\. "marec"\. "apr\u00edl"\. "m\u00e1j"\. "j\u00fan"\. "j\u00fal"\. "august"\. "september"\. "okt\u00f3ber"\. "november"\. "december"\. ""]. ::msgcat::mcset sk BCE
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1164
                                                                                                                                                                                                                          Entropy (8bit):4.26110325084843
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8PyUpd4+RfscasS9CErTByism1KSCvt1vJo6:462U/ENsqrTtVEtRx
                                                                                                                                                                                                                          MD5:2566BDE28B17C526227634F1B4FC7047
                                                                                                                                                                                                                          SHA1:BE6940EC9F4C5E228F043F9D46A42234A02F4A03
                                                                                                                                                                                                                          SHA-256:BD488C9D791ABEDF698B66B768E2BF24251FFEAF06F53FB3746CAB457710FF77
                                                                                                                                                                                                                          SHA-512:CC684BFC82CA55240C5B542F3F63E0FF43AEF958469B3978E414261BC4FADB50A0AE3554CF2468AC88E4DDB70D2258296C0A2FBB69312223EED56C7C03FEC17C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sl DAYS_OF_WEEK_ABBREV [list \. "Ned"\. "Pon"\. "Tor"\. "Sre"\. "\u010cet"\. "Pet"\. "Sob"]. ::msgcat::mcset sl DAYS_OF_WEEK_FULL [list \. "Nedelja"\. "Ponedeljek"\. "Torek"\. "Sreda"\. "\u010cetrtek"\. "Petek"\. "Sobota"]. ::msgcat::mcset sl MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "avg"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sl MONTHS_FULL [list \. "januar"\. "februar"\. "marec"\. "april"\. "maj"\. "junij"\. "julij"\. "avgust"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sl BCE "pr.n.\u0161.". ::msgcat::mcset sl CE "p
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1267
                                                                                                                                                                                                                          Entropy (8bit):4.339253133089184
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu82qJw7W5wO6jwbNU7FtHhoJCLov4v2:46iWrvGtBo6+O2
                                                                                                                                                                                                                          MD5:931A009F7E8A376972DE22AD5670EC88
                                                                                                                                                                                                                          SHA1:44AEF01F568250851099BAA8A536FBBACD3DEBBB
                                                                                                                                                                                                                          SHA-256:CB27007E138315B064576C17931280CFE6E6929EFC3DAFD7171713D204CFC3BF
                                                                                                                                                                                                                          SHA-512:47B230271CD362990C581CD6C06B0BCEA23E10E03D927C7C28415739DB3541D69D1B87DF554E9B4F00ECCAAB0F6AC0565F9EB0DEA8B75C54A90B2D53C928D379
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sq DAYS_OF_WEEK_ABBREV [list \. "Die"\. "H\u00ebn"\. "Mar"\. "M\u00ebr"\. "Enj"\. "Pre"\. "Sht"]. ::msgcat::mcset sq DAYS_OF_WEEK_FULL [list \. "e diel"\. "e h\u00ebn\u00eb"\. "e mart\u00eb"\. "e m\u00ebrkur\u00eb"\. "e enjte"\. "e premte"\. "e shtun\u00eb"]. ::msgcat::mcset sq MONTHS_ABBREV [list \. "Jan"\. "Shk"\. "Mar"\. "Pri"\. "Maj"\. "Qer"\. "Kor"\. "Gsh"\. "Sht"\. "Tet"\. "N\u00ebn"\. "Dhj"\. ""]. ::msgcat::mcset sq MONTHS_FULL [list \. "janar"\. "shkurt"\. "mars"\. "prill"\. "maj"\. "qershor"\. "korrik"\. "gusht"\. "shtator"\. "tetor"\. "n\u00ebntor"\. "dhjetor"\. ""]. ::msgcat::mcset sq BCE "p.e.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2035
                                                                                                                                                                                                                          Entropy (8bit):4.24530896413441
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46qoQCSdQqQP4QSsIVKP10NupiuQxQaQLlKnM28nGtfR:hjIX15VKP6NmBU3YKnFbp
                                                                                                                                                                                                                          MD5:5CA16D93718AAA813ADE746440CF5CE6
                                                                                                                                                                                                                          SHA1:A142733052B87CA510B8945256399CE9F873794C
                                                                                                                                                                                                                          SHA-256:313E8CDBBC0288AED922B9927A7331D0FAA2E451D4174B1F5B76C5C9FAEC8F9B
                                                                                                                                                                                                                          SHA-512:4D031F9BA75D45EC89B2C74A870CCDA41587650D7F9BC91395F68B70BA3CD7A7105E70C19D139D20096533E06F5787C00EA850E27C4ADCF5A28572480D39B639
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sr DAYS_OF_WEEK_ABBREV [list \. "\u041d\u0435\u0434"\. "\u041f\u043e\u043d"\. "\u0423\u0442\u043e"\. "\u0421\u0440\u0435"\. "\u0427\u0435\u0442"\. "\u041f\u0435\u0442"\. "\u0421\u0443\u0431"]. ::msgcat::mcset sr DAYS_OF_WEEK_FULL [list \. "\u041d\u0435\u0434\u0435\u0459\u0430"\. "\u041f\u043e\u043d\u0435\u0434\u0435\u0459\u0430\u043a"\. "\u0423\u0442\u043e\u0440\u0430\u043a"\. "\u0421\u0440\u0435\u0434\u0430"\. "\u0427\u0435\u0442\u0432\u0440\u0442\u0430\u043a"\. "\u041f\u0435\u0442\u0430\u043a"\. "\u0421\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset sr MONTHS_ABBREV [list \. "\u0408\u0430\u043d"\. "\u0424\u0435\u0431"\. "\u041c\u0430\u0440"\. "\u0410\u043f\u0440"\. "\u041c\u0430\u0458"\. "\u0408\u0443\u043d"\. "\u0408\u0443\u043b"\.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1167
                                                                                                                                                                                                                          Entropy (8bit):4.2825791311526515
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8JLmAQVm/xTsS9CfxTlijQkcjKxFvivn:46hVQc/psJxT8kyhkn
                                                                                                                                                                                                                          MD5:496D9183E2907199056CA236438498E1
                                                                                                                                                                                                                          SHA1:D9C3BB4AEBD9BFD942593694E796A8C2FB9217B8
                                                                                                                                                                                                                          SHA-256:4F32E1518BE3270F4DB80136FAC0031C385DD3CE133FAA534F141CF459C6113A
                                                                                                                                                                                                                          SHA-512:FA7FDEDDC42C36D0A60688CDBFE9A2060FE6B2644458D1EBFC817F1E5D5879EB3E3C78B5E53E9D3F42E2E4D84C93C4A7377170986A437EFF404F310D1D72F135
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sv DAYS_OF_WEEK_ABBREV [list \. "s\u00f6"\. "m\u00e5"\. "ti"\. "on"\. "to"\. "fr"\. "l\u00f6"]. ::msgcat::mcset sv DAYS_OF_WEEK_FULL [list \. "s\u00f6ndag"\. "m\u00e5ndag"\. "tisdag"\. "onsdag"\. "torsdag"\. "fredag"\. "l\u00f6rdag"]. ::msgcat::mcset sv MONTHS_ABBREV [list \. "jan"\. "feb"\. "mar"\. "apr"\. "maj"\. "jun"\. "jul"\. "aug"\. "sep"\. "okt"\. "nov"\. "dec"\. ""]. ::msgcat::mcset sv MONTHS_FULL [list \. "januari"\. "februari"\. "mars"\. "april"\. "maj"\. "juni"\. "juli"\. "augusti"\. "september"\. "oktober"\. "november"\. "december"\. ""]. ::msgcat::mcset sv BCE "f.Kr.". ::msgcat::mcset sv C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):991
                                                                                                                                                                                                                          Entropy (8bit):4.024338627988864
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8r4mc4Go/4mtVfqRvodJ3fjESBToOqe3lHvFgdF6A3ixTZ6OM5mSYoC6Vy:4azu88kGDiq1qhbJ75V9gZSpgmSm9
                                                                                                                                                                                                                          MD5:4DB24BA796D86ADF0441D2E75DE0C07E
                                                                                                                                                                                                                          SHA1:9935B36FF2B1C6DFDE3EC375BC471A0E93D1F7E3
                                                                                                                                                                                                                          SHA-256:6B5AB8AE265DB436B15D32263A8870EC55C7C0C07415B3F9BAAC37F73BC704E5
                                                                                                                                                                                                                          SHA-512:BE7ED0559A73D01537A1E51941ED19F0FEC3F14F9527715CB119E89C97BD31CC6102934B0349D8D0554F5EDD9E3A02978F7DE4919C000A77BD353F7033A4A95B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset sw DAYS_OF_WEEK_ABBREV [list \. "Jpi"\. "Jtt"\. "Jnn"\. "Jtn"\. "Alh"\. "Iju"\. "Jmo"]. ::msgcat::mcset sw DAYS_OF_WEEK_FULL [list \. "Jumapili"\. "Jumatatu"\. "Jumanne"\. "Jumatano"\. "Alhamisi"\. "Ijumaa"\. "Jumamosi"]. ::msgcat::mcset sw MONTHS_ABBREV [list \. "Jan"\. "Feb"\. "Mar"\. "Apr"\. "Mei"\. "Jun"\. "Jul"\. "Ago"\. "Sep"\. "Okt"\. "Nov"\. "Des"\. ""]. ::msgcat::mcset sw MONTHS_FULL [list \. "Januari"\. "Februari"\. "Machi"\. "Aprili"\. "Mei"\. "Juni"\. "Julai"\. "Agosti"\. "Septemba"\. "Oktoba"\. "Novemba"\. "Desemba"\. ""]. ::msgcat::mcset sw BCE "KK". ::msgcat::mcset sw CE "BK".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1835
                                                                                                                                                                                                                          Entropy (8bit):4.018233695396
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu83w0xn8dnzhmmlmYgtg+CKf6CO5ztFSLt8tCtGtv+CKf6CO5ztFSLt8tCtNu:46k0dgmmlmYgtE/t1H
                                                                                                                                                                                                                          MD5:2D9C969318D1740049D28EBBD4F62C1D
                                                                                                                                                                                                                          SHA1:121665081AFC33DDBCF679D7479BF0BC47FEF716
                                                                                                                                                                                                                          SHA-256:30A142A48E57F194ECC3AA9243930F3E6E1B4E8B331A8CDD2705EC9C280DCCBB
                                                                                                                                                                                                                          SHA-512:7C32907C39BFB89F558692535041B2A7FA18A64E072F5CF9AB95273F3AC5A7C480B4F953B13484A07AA4DA822613E27E78CC7B02ACE7A61E58FDB5507D7579C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta DAYS_OF_WEEK_FULL [list \. "\u0b9e\u0bbe\u0baf\u0bbf\u0bb1\u0bc1"\. "\u0ba4\u0bbf\u0b99\u0bcd\u0b95\u0bb3\u0bcd"\. "\u0b9a\u0bc6\u0bb5\u0bcd\u0bb5\u0bbe\u0baf\u0bcd"\. "\u0baa\u0bc1\u0ba4\u0ba9\u0bcd"\. "\u0bb5\u0bbf\u0baf\u0bbe\u0bb4\u0ba9\u0bcd"\. "\u0bb5\u0bc6\u0bb3\u0bcd\u0bb3\u0bbf"\. "\u0b9a\u0ba9\u0bbf"]. ::msgcat::mcset ta MONTHS_ABBREV [list \. "\u0b9c\u0ba9\u0bb5\u0bb0\u0bbf"\. "\u0baa\u0bc6\u0baa\u0bcd\u0bb0\u0bb5\u0bb0\u0bbf"\. "\u0bae\u0bbe\u0bb0\u0bcd\u0b9a\u0bcd"\. "\u0b8f\u0baa\u0bcd\u0bb0\u0bb2\u0bcd"\. "\u0bae\u0bc7"\. "\u0b9c\u0bc2\u0ba9\u0bcd"\. "\u0b9c\u0bc2\u0bb2\u0bc8"\. "\u0b86\u0b95\u0bb8\u0bcd\u0b9f\u0bcd"\. "\u0b9a\u0bc6\u0baa\u0bcd\u0b9f\u0bae\u0bcd\u0baa\u0bb0\u0bcd"\. "\u0b85\u0b95\u0bcd\u0b9f\u0bcb\u0baa\u0bb0\u0bcd"\. "\u0ba8\u0bb
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):251
                                                                                                                                                                                                                          Entropy (8bit):4.815592015875268
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmosDv+9/LosK3v6rZosDo+3v+6f6HK:4EnLzu8eDvWbK3v6r5DF3vmq
                                                                                                                                                                                                                          MD5:293456B39BE945C55536A5DD894787F0
                                                                                                                                                                                                                          SHA1:94DEF0056C7E3082E58266BCE436A61C045EA394
                                                                                                                                                                                                                          SHA-256:AA57D5FB5CC3F59EC6A3F99D7A5184403809AA3A3BC02ED0842507D4218B683D
                                                                                                                                                                                                                          SHA-512:AB763F2932F2FF48AC18C8715F661F7405607E1818B53E0D0F32184ABE67714F03A39A9D0637D0D93CE43606C3E1D702D2A3F8660C288F61DFE852747B652B59
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset ta_IN DATE_FORMAT "%d %M %Y". ::msgcat::mcset ta_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset ta_IN DATE_TIME_FORMAT "%d %M %Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2102
                                                                                                                                                                                                                          Entropy (8bit):4.034298184367717
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46x9mcib30Rgu1je5YdnULEP8l1je5YdnULEPt:hnIb39ufbufV
                                                                                                                                                                                                                          MD5:0B9B124076C52A503A906059F7446077
                                                                                                                                                                                                                          SHA1:F43A0F6CCBDDBDD5EA140C7FA55E9A82AB910A03
                                                                                                                                                                                                                          SHA-256:42C34D02A6079C4D0D683750B3809F345637BC6D814652C3FB0B344B66B70C79
                                                                                                                                                                                                                          SHA-512:234B9ACA1823D1D6B82583727B4EA68C014D59916B410CB9B158FA1954B6FC3767A261BD0B9F592AF0663906ADF11C2C9A3CC0A325CB1FF58F42A884AF7CB015
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te DAYS_OF_WEEK_ABBREV [list \. "\u0c06\u0c26\u0c3f"\. "\u0c38\u0c4b\u0c2e"\. "\u0c2e\u0c02\u0c17\u0c33"\. "\u0c2c\u0c41\u0c27"\. "\u0c17\u0c41\u0c30\u0c41"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30"\. "\u0c36\u0c28\u0c3f"]. ::msgcat::mcset te DAYS_OF_WEEK_FULL [list \. "\u0c06\u0c26\u0c3f\u0c35\u0c3e\u0c30\u0c02"\. "\u0c38\u0c4b\u0c2e\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2e\u0c02\u0c17\u0c33\u0c35\u0c3e\u0c30\u0c02"\. "\u0c2c\u0c41\u0c27\u0c35\u0c3e\u0c30\u0c02"\. "\u0c17\u0c41\u0c30\u0c41\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c41\u0c15\u0c4d\u0c30\u0c35\u0c3e\u0c30\u0c02"\. "\u0c36\u0c28\u0c3f\u0c35\u0c3e\u0c30\u0c02"]. ::msgcat::mcset te MONTHS_ABBREV [list \. "\u0c1c\u0c28\u0c35\u0c30\u0c3f"\. "\u0c2b\u0c3f\u0c2c\u0c4d\u0c30\u0c35\u0c30\u0c3f"\. "\u0c2e\u0c3e\u0c30\u0c4d\u0c1a\u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):411
                                                                                                                                                                                                                          Entropy (8bit):5.01781242466238
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8CjZWsn0sEjoD0sLvUFS3v6r5F3vMq:4azu84Z1nnEjoDnLvUFEvS5NvMq
                                                                                                                                                                                                                          MD5:443E34E2E2BC7CB64A8BA52D99D6B4B6
                                                                                                                                                                                                                          SHA1:D323C03747FE68E9B73F7E5C1E10B168A40F2A2F
                                                                                                                                                                                                                          SHA-256:88BDAF4B25B684B0320A2E11D3FE77DDDD25E3B17141BD7ED1D63698C480E4BA
                                                                                                                                                                                                                          SHA-512:5D8B267530EC1480BF3D571AABC2DA7B4101EACD7FB03B49049709E39D665DD7ACB66FD785BA2B5203DDC54C520434219D2D9974A1E9EE74C659FFAEA6B694E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset te_IN AM "\u0c2a\u0c42\u0c30\u0c4d\u0c35\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN PM "\u0c05\u0c2a\u0c30\u0c3e\u0c39\u0c4d\u0c28". ::msgcat::mcset te_IN DATE_FORMAT "%d/%m/%Y". ::msgcat::mcset te_IN TIME_FORMAT_12 "%I:%M:%S %P". ::msgcat::mcset te_IN DATE_TIME_FORMAT "%d/%m/%Y %I:%M:%S %P %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2305
                                                                                                                                                                                                                          Entropy (8bit):4.324407451316591
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46P4QX/wQT0H/u3rPc8JD57XWWND8QM70xJi53Ljtef:hQ556rVDWZcLOO
                                                                                                                                                                                                                          MD5:D145F9DF0E339A2538662BD752F02E16
                                                                                                                                                                                                                          SHA1:AFD97F8E8CC14D306DEDD78F8F395738E38A8569
                                                                                                                                                                                                                          SHA-256:F9641A6EBE3845CE5D36CED473749F5909C90C52E405F074A6DA817EF6F39867
                                                                                                                                                                                                                          SHA-512:E17925057560462F730CF8288856E46FA1F1D2A10B5D4D343257B7687A3855014D5C65B6C85AC55A7C77B8B355DB19F053C74B91DFA7BE7E9F933D9D4DA117F7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset th DAYS_OF_WEEK_ABBREV [list \. "\u0e2d\u0e32."\. "\u0e08."\. "\u0e2d."\. "\u0e1e."\. "\u0e1e\u0e24."\. "\u0e28."\. "\u0e2a."]. ::msgcat::mcset th DAYS_OF_WEEK_FULL [list \. "\u0e27\u0e31\u0e19\u0e2d\u0e32\u0e17\u0e34\u0e15\u0e22\u0e4c"\. "\u0e27\u0e31\u0e19\u0e08\u0e31\u0e19\u0e17\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e2d\u0e31\u0e07\u0e04\u0e32\u0e23"\. "\u0e27\u0e31\u0e19\u0e1e\u0e38\u0e18"\. "\u0e27\u0e31\u0e19\u0e1e\u0e24\u0e2b\u0e31\u0e2a\u0e1a\u0e14\u0e35"\. "\u0e27\u0e31\u0e19\u0e28\u0e38\u0e01\u0e23\u0e4c"\. "\u0e27\u0e31\u0e19\u0e40\u0e2a\u0e32\u0e23\u0e4c"]. ::msgcat::mcset th MONTHS_ABBREV [list \. "\u0e21.\u0e04."\. "\u0e01.\u0e1e."\. "\u0e21\u0e35.\u0e04."\. "\u0e40\u0e21.\u0e22."\. "\u0e1e.\u0e04."\. "\u0e21\u0e34.\u0e22."\. "\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1133
                                                                                                                                                                                                                          Entropy (8bit):4.32041719596907
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu80VAFVsNTib5vk5CfYTnGk65GmogWFLNvoKvWI3:46j8NTgwVTnlSJWFLJvWI3
                                                                                                                                                                                                                          MD5:3AFAD9AD82A9C8B754E2FE8FC0094BAB
                                                                                                                                                                                                                          SHA1:4EE3E2DF86612DB314F8D3E7214D7BE241AA1A32
                                                                                                                                                                                                                          SHA-256:DF7C4BA67457CB47EEF0F5CA8E028FF466ACDD877A487697DC48ECAC7347AC47
                                                                                                                                                                                                                          SHA-512:79A6738A97B7DB9CA4AE9A3BA1C3E56BE9AC67E71AE12154FD37A37D78892B6414A49E10E007DE2EB314942DC017B87FAB7C64B74EC9B889DAEBFF9B3B78E644
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset tr DAYS_OF_WEEK_ABBREV [list \. "Paz"\. "Pzt"\. "Sal"\. "\u00c7ar"\. "Per"\. "Cum"\. "Cmt"]. ::msgcat::mcset tr DAYS_OF_WEEK_FULL [list \. "Pazar"\. "Pazartesi"\. "Sal\u0131"\. "\u00c7ar\u015famba"\. "Per\u015fembe"\. "Cuma"\. "Cumartesi"]. ::msgcat::mcset tr MONTHS_ABBREV [list \. "Oca"\. "\u015eub"\. "Mar"\. "Nis"\. "May"\. "Haz"\. "Tem"\. "A\u011fu"\. "Eyl"\. "Eki"\. "Kas"\. "Ara"\. ""]. ::msgcat::mcset tr MONTHS_FULL [list \. "Ocak"\. "\u015eubat"\. "Mart"\. "Nisan"\. "May\u0131s"\. "Haziran"\. "Temmuz"\. "A\u011fustos"\. "Eyl\u00fcl"\. "Ekim"\. "Kas\u0131m"\. "Aral\u0131k"\. ""]. ::msgcat::mcset tr D
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2113
                                                                                                                                                                                                                          Entropy (8bit):4.227105489438195
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:46+ytFoQAQPHUKPo6eQ4QBuQ0WbQcJeyFQDWZlQD1QbS7XQn1Q7mDaSAJQ7GMLzM:hIpP5tzYhTUhAgEAE+
                                                                                                                                                                                                                          MD5:458A38F894B296C83F85A53A92FF8520
                                                                                                                                                                                                                          SHA1:CE26187875E334C712FDAB73E6B526247C6FE1CF
                                                                                                                                                                                                                          SHA-256:CF2E78EF3322F0121E958098EF5F92DA008344657A73439EAC658CB6BF3D72BD
                                                                                                                                                                                                                          SHA-512:3B8730C331CF29EF9DEDBC9D5A53C50D429931B8DA01EE0C20DAE25B995114966DB9BC576BE0696DEC088DB1D88B50DE2C376275AB5251F49F6544E546BBC531
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset uk DAYS_OF_WEEK_ABBREV [list \. "\u043d\u0434"\. "\u043f\u043d"\. "\u0432\u0442"\. "\u0441\u0440"\. "\u0447\u0442"\. "\u043f\u0442"\. "\u0441\u0431"]. ::msgcat::mcset uk DAYS_OF_WEEK_FULL [list \. "\u043d\u0435\u0434\u0456\u043b\u044f"\. "\u043f\u043e\u043d\u0435\u0434\u0456\u043b\u043e\u043a"\. "\u0432\u0456\u0432\u0442\u043e\u0440\u043e\u043a"\. "\u0441\u0435\u0440\u0435\u0434\u0430"\. "\u0447\u0435\u0442\u0432\u0435\u0440"\. "\u043f'\u044f\u0442\u043d\u0438\u0446\u044f"\. "\u0441\u0443\u0431\u043e\u0442\u0430"]. ::msgcat::mcset uk MONTHS_ABBREV [list \. "\u0441\u0456\u0447"\. "\u043b\u044e\u0442"\. "\u0431\u0435\u0440"\. "\u043a\u0432\u0456\u0442"\. "\u0442\u0440\u0430\u0432"\. "\u0447\u0435\u0440\u0432"\. "\u043b\u0438\u043f"\. "\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1421
                                                                                                                                                                                                                          Entropy (8bit):4.382223858419589
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:4azu8pNu9UT5xDHy2W82yGWnf/oxHFBSWWS1D/avSv16:46Oixzy2IyhwZ17cU16
                                                                                                                                                                                                                          MD5:3BD0AB95976D1B80A30547E4B23FD595
                                                                                                                                                                                                                          SHA1:B3E5DC095973E46D8808326B2A1FC45046B5267F
                                                                                                                                                                                                                          SHA-256:9C69094C0BD52D5AE8448431574EAE8EE4BE31EC2E8602366DF6C6BF4BC89A58
                                                                                                                                                                                                                          SHA-512:2A68A7ADC385EDEA02E4558884A24DCC6328CC9F7D459CC03CC9F2D2F58CF6FF2103AD5B45C6D05B7E13F28408C6B05CDDF1DF60E822E5095F86A49052E19E59
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset vi DAYS_OF_WEEK_ABBREV [list \. "Th 2"\. "Th 3"\. "Th 4"\. "Th 5"\. "Th 6"\. "Th 7"\. "CN"]. ::msgcat::mcset vi DAYS_OF_WEEK_FULL [list \. "Th\u01b0\u0301 hai"\. "Th\u01b0\u0301 ba"\. "Th\u01b0\u0301 t\u01b0"\. "Th\u01b0\u0301 n\u0103m"\. "Th\u01b0\u0301 s\u00e1u"\. "Th\u01b0\u0301 ba\u0309y"\. "Chu\u0309 nh\u00e2\u0323t"]. ::msgcat::mcset vi MONTHS_ABBREV [list \. "Thg 1"\. "Thg 2"\. "Thg 3"\. "Thg 4"\. "Thg 5"\. "Thg 6"\. "Thg 7"\. "Thg 8"\. "Thg 9"\. "Thg 10"\. "Thg 11"\. "Thg 12"\. ""]. ::msgcat::mcset vi MONTHS_FULL [list \. "Th\u00e1ng m\u00f4\u0323t"\. "Th\u00e1ng hai"\. "Th\u00e1ng ba"\. "Th\u00e1ng t\u01b0"\. "Th\u00e1ng n\u0103m"\. "Th\u00e1ng s\
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (1598)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3330
                                                                                                                                                                                                                          Entropy (8bit):4.469203967086526
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:468jDI/Tw71xDqwPqDa8c3FLbYmhyvMDKbW0YGLuoEyzag29dL:hn7wRdNL
                                                                                                                                                                                                                          MD5:9C33FFDD4C13D2357AB595EC3BA70F04
                                                                                                                                                                                                                          SHA1:A87F20F7A331DEFC33496ECDA50D855C8396E040
                                                                                                                                                                                                                          SHA-256:EF81B41EC69F67A394ECE2B3983B67B3D0C8813624C2BFA1D8A8C15B21608AC9
                                                                                                                                                                                                                          SHA-512:E31EEE90660236BCD958F3C540F56B2583290BAD6086AE78198A0819A92CF2394C62DE3800FDDD466A8068F4CABDFBCA46A648D419B1D0103381BF428D721B13
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh DAYS_OF_WEEK_ABBREV [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh DAYS_OF_WEEK_FULL [list \. "\u661f\u671f\u65e5"\. "\u661f\u671f\u4e00"\. "\u661f\u671f\u4e8c"\. "\u661f\u671f\u4e09"\. "\u661f\u671f\u56db"\. "\u661f\u671f\u4e94"\. "\u661f\u671f\u516d"]. ::msgcat::mcset zh MONTHS_ABBREV [list \. "\u4e00\u6708"\. "\u4e8c\u6708"\. "\u4e09\u6708"\. "\u56db\u6708"\. "\u4e94\u6708"\. "\u516d\u6708"\. "\u4e03\u6708"\. "\u516b\u6708"\. "\u4e5d\u6708"\. "\u5341\u6708"\. "\u5341\u4e00\u6708"\. "\u5341\u4e8c\u6708"\. ""]. ::msgcat::mcset zh MONTHS_FULL [list \.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):312
                                                                                                                                                                                                                          Entropy (8bit):5.1281364096481665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoX5HoHJ+3vtfNrFLoHJ+3v6MY+oXa+3vYq9:4EnLzu8d5eJ+3vtNEJ+3v6L1L3vYq9
                                                                                                                                                                                                                          MD5:EB94B41551EAAFFA5DF4F406C7ACA3A4
                                                                                                                                                                                                                          SHA1:B0553108BDE43AA7ED362E2BFFAF1ABCA1567491
                                                                                                                                                                                                                          SHA-256:85F91CF6E316774AA5D0C1ECA85C88E591FD537165BB79929C5E6A1CA99E56C8
                                                                                                                                                                                                                          SHA-512:A0980A6F1AD9236647E4F18CC104999DB2C523153E8716FD0CFE57320E906DF80378A5C0CDE132F2C53F160F5304EAF34910D7D1BB5753987D74AFBC0B6F75F3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_CN DATE_FORMAT "%Y-%m-%e". ::msgcat::mcset zh_CN TIME_FORMAT "%k:%M:%S". ::msgcat::mcset zh_CN TIME_FORMAT_12 "%P%I\u65f6%M\u5206%S\u79d2". ::msgcat::mcset zh_CN DATE_TIME_FORMAT "%Y-%m-%e %k:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):752
                                                                                                                                                                                                                          Entropy (8bit):4.660158381384211
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:4EnLzu8qmDBHZLX+TyW4OU5yPgM9Lz+SC3WwLNMW3v6G3v3Ww+:4azu8qyFOw3WwLrvTv3Ww+
                                                                                                                                                                                                                          MD5:D8C6BFBFCE44B6A8A038BA44CB3DB550
                                                                                                                                                                                                                          SHA1:FBD609576E65B56EDA67FD8A1801A27B43DB5486
                                                                                                                                                                                                                          SHA-256:D123E0B4C2614F680808B58CCA0C140BA187494B2C8BCF8C604C7EB739C70882
                                                                                                                                                                                                                          SHA-512:3455145CF5C77FC847909AB1A283452D0C877158616C8AA7BDFFC141B86B2E66F9FF45C3BB6A4A9D758D2F8FFCB1FE919477C4553EFE527C0EDC912EBBCAABCD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_HK DAYS_OF_WEEK_ABBREV [list \. "\u65e5"\. "\u4e00"\. "\u4e8c"\. "\u4e09"\. "\u56db"\. "\u4e94"\. "\u516d"]. ::msgcat::mcset zh_HK MONTHS_ABBREV [list \. "1\u6708"\. "2\u6708"\. "3\u6708"\. "4\u6708"\. "5\u6708"\. "6\u6708"\. "7\u6708"\. "8\u6708"\. "9\u6708"\. "10\u6708"\. "11\u6708"\. "12\u6708"\. ""]. ::msgcat::mcset zh_HK DATE_FORMAT "%Y\u5e74%m\u6708%e\u65e5". ::msgcat::mcset zh_HK TIME_FORMAT_12 "%P%I:%M:%S". ::msgcat::mcset zh_HK DATE_TIME_FORMAT "%Y\u5e74%m\u6708%e\u65e5 %P%I:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):339
                                                                                                                                                                                                                          Entropy (8bit):5.020358587042703
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoOpxoPpSocvNLohX3v6ZhLoh+3v6fJ:4EnLzu8WvNo3v6b3vu
                                                                                                                                                                                                                          MD5:E0BC93B8F050D6D80B8173FF4FA4D7B7
                                                                                                                                                                                                                          SHA1:231FF1B6F859D0261F15D2422DF09E756CE50CCB
                                                                                                                                                                                                                          SHA-256:2683517766AF9DA0D87B7A862DE9ADEA82D9A1454FC773A9E3C1A6D92ABA947A
                                                                                                                                                                                                                          SHA-512:8BA6EAC5F71167B83A58B47123ACF7939C348FE2A0CA2F092FE9F60C0CCFB901ADA0E8F2101C282C39BAE86C918390985731A8F66E481F8074732C37CD50727F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_SG AM "\u4e0a\u5348". ::msgcat::mcset zh_SG PM "\u4e2d\u5348". ::msgcat::mcset zh_SG DATE_FORMAT "%d %B %Y". ::msgcat::mcset zh_SG TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_SG DATE_TIME_FORMAT "%d %B %Y %P %I:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):346
                                                                                                                                                                                                                          Entropy (8bit):5.08314435797197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSyEtJLlpuoo6dmoAykaRULH/XRxvBoAyjZRULH5oAyU/G0OZoAyxW3v6ZhLoAR:4EnLzu8I5xEOKRWW3v6w3v8AC
                                                                                                                                                                                                                          MD5:9CD17E7F28186E0E71932CC241D1CBB1
                                                                                                                                                                                                                          SHA1:AF1EE536AABB8198BA88D3474ED49F76A37E89FF
                                                                                                                                                                                                                          SHA-256:D582406C51A3DB1EADF6507C50A1F85740FDA7DA8E27FC1438FEB6242900CB12
                                                                                                                                                                                                                          SHA-512:4712DD6A27A09EA339615FC3D17BC8E4CD64FF12B2B8012E01FD4D3E7789263899FA05EDDB77044DC7B7D32B3DC55A52B8320D93499DF9A6799A8E4D07174525
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/loadICU.tcl -- do not edit.namespace eval ::tcl::clock {. ::msgcat::mcset zh_TW BCE "\u6c11\u570b\u524d". ::msgcat::mcset zh_TW CE "\u6c11\u570b". ::msgcat::mcset zh_TW DATE_FORMAT "%Y/%m/%e". ::msgcat::mcset zh_TW TIME_FORMAT_12 "%P %I:%M:%S". ::msgcat::mcset zh_TW DATE_TIME_FORMAT "%Y/%m/%e %P %I:%M:%S %z".}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32718
                                                                                                                                                                                                                          Entropy (8bit):4.5415166585248645
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:UczgW5gzrui4sKDt9C7sGbHMmjJbuQH8A2Q:VgTrrvf7sGbHDFSQH8/Q
                                                                                                                                                                                                                          MD5:1A7DF33BC47D63F9CE1D4FF70A974FA3
                                                                                                                                                                                                                          SHA1:513EC2215E2124D9A6F6DF2549C1442109E117C0
                                                                                                                                                                                                                          SHA-256:C5D74E1C927540A3F524E6B929D0956EFBA0797FB8D55918EF69D27DF57DEDA3
                                                                                                                                                                                                                          SHA-512:F671D5A46382EDFBDA49A6EDB9E6CF2D5CEBD83CE4ADD6B717A478D52748332D41DA3743182D4555B801B96A318D29DFC6AC36B32983ADB32D329C24F8A3D713
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# optparse.tcl --.#.# (private) Option parsing package.# Primarily used internally by the safe:: code..#.#.WARNING: This code will go away in a future release.#.of Tcl. It is NOT supported and you should not rely.#.on it. If your code does rely on this package you.#.may directly incorporate this code into your application...package require Tcl 8.2.# When this version number changes, update the pkgIndex.tcl file.# and the install directory in the Makefiles..package provide opt 0.4.6..namespace eval ::tcl {.. # Exported APIs. namespace export OptKeyRegister OptKeyDelete OptKeyError OptKeyParse \. OptProc OptProcArgGiven OptParse \.. Lempty Lget \. Lassign Lvarpop Lvarpop1 Lvarset Lvarincr \. SetMax SetMin...################# Example of use / 'user documentation' ###################.. proc OptCreateTestProc {} {...# Defines ::tcl::OptParseTest as a test proc with parsed arguments..# (can't be defined before the code below is
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):607
                                                                                                                                                                                                                          Entropy (8bit):4.652658850873767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:jHxJRuMopS42wyGlTajUA43KXks4L1GbyvX6VxQ+pBbX:bvRmS42wyGlTah9XkbL7X6VxBB
                                                                                                                                                                                                                          MD5:92FF1E42CFC5FECCE95068FC38D995B3
                                                                                                                                                                                                                          SHA1:B2E71842F14D5422A9093115D52F19BCCA1BF881
                                                                                                                                                                                                                          SHA-256:EB9925A8F0FCC7C2A1113968AB0537180E10C9187B139C8371ADF821C7B56718
                                                                                                                                                                                                                          SHA-512:608D436395D055C5449A53208F3869B8793DF267B8476AD31BCDD9659A222797814832720C495D938E34BF7D253FFC3F01A73CC0399C0DFB9C85D2789C7F11C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl package index file, version 1.1.# This file is generated by the "pkg_mkIndex -direct" command.# and sourced either when an application starts up or.# by a "package unknown" script. It invokes the.# "package ifneeded" command to set up package-related.# information so that packages will be loaded automatically.# in response to "package require" commands. When this.# script is sourced, the variable $dir must contain the.# full path name of this file's directory...if {![package vsatisfies [package provide Tcl] 8.2]} {return}.package ifneeded opt 0.4.6 [list source [file join $dir optparse.tcl]].
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):22959
                                                                                                                                                                                                                          Entropy (8bit):4.836555290409911
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:I72oQXm9jcLyBLWueSzvAXMiow90l3NhETrh4NLTluYhoNL3ZAqYi:I72oQXmgyBCqvAcFw2dhOrh4NZVhoN3F
                                                                                                                                                                                                                          MD5:55E2DB5DCF8D49F8CD5B7D64FEA640C7
                                                                                                                                                                                                                          SHA1:8FDC28822B0CC08FA3569A14A8C96EDCA03BFBBD
                                                                                                                                                                                                                          SHA-256:47B6AF117199B1511F6103EC966A58E2FD41F0ABA775C44692B2069F6ED10BAD
                                                                                                                                                                                                                          SHA-512:824C210106DE7EAE57A480E3F6E3A5C8FB8AC4BBF0A0A386D576D3EB2A3AC849BDFE638428184056DA9E81767E2B63EFF8E18068A1CF5149C9F8A018F817D3E5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# package.tcl --.#.# utility procs formerly in init.tcl which can be loaded on demand.# for package management..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval tcl::Pkg {}..# ::tcl::Pkg::CompareExtension --.#.# Used internally by pkg_mkIndex to compare the extension of a file to a given.# extension. On Windows, it uses a case-insensitive comparison because the.# file system can be file insensitive..#.# Arguments:.# fileName.name of a file whose extension is compared.# ext..(optional) The extension to compare against; you must.#..provide the starting dot..#..Defaults to [info sharedlibextension].#.# Results:.# Returns 1 if the extension matches, 0 otherwise..proc tcl::Pkg::CompareExtension {fileName {ext {}}} {. global tcl_platform. if {$ext eq ""} {set ext
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):816
                                                                                                                                                                                                                          Entropy (8bit):4.833285375693491
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:TcS2n1RBbgZKaNHaeYFSxYmXqt9IGUafZwXgEImK7k35IpbdELS8/McjbPgnE:TcHn5sZKGkwa/JxfJmRGNc93j7CE
                                                                                                                                                                                                                          MD5:FCDAF75995F2CCE0A5D5943E9585590D
                                                                                                                                                                                                                          SHA1:A0B1BD4E68DCE1768D3C5E0D3C7B31E28021D3BA
                                                                                                                                                                                                                          SHA-256:EBE5A2B4CBBCD7FD3F7A6F76D68D7856301DB01B350C040942A7B806A46E0014
                                                                                                                                                                                                                          SHA-512:A632D0169EE3B6E6B7EF73F5FBA4B7897F9491BDB389D78165E297252424546EFB43895D3DD530864B9FCF2ECF5BCE7DA8E55BA5B4F20E23E1E45ADDAF941C11
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# parray:.# Print the contents of a global array on stdout..#.# Copyright (c) 1991-1993 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..proc parray {a {pattern *}} {. upvar 1 $a array. if {![array exists array]} {..return -code error "\"$a\" isn't an array". }. set maxl 0. set names [lsort [array names array $pattern]]. foreach name $names {..if {[string length $name] > $maxl} {.. set maxl [string length $name]..}. }. set maxl [expr {$maxl + [string length $a] + 2}]. foreach name $names {..set nameString [format %s(%s) $a $name]..puts stdout [format "%-*s = %s" $maxl $nameString $array($name)]. }.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33439
                                                                                                                                                                                                                          Entropy (8bit):4.750571844372246
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:OovFcXxzYqZ1//L2J4lb77BvnthiV0EnoQI4MnNhGQmzY3wKIYkA:OovFcqqZF2J4lb7Rrg0EnoQI4INhGrzu
                                                                                                                                                                                                                          MD5:325A573F30C9EA70FD891E85664E662C
                                                                                                                                                                                                                          SHA1:6EC3F21EBCFD269847C43891DAD96189FACF20E4
                                                                                                                                                                                                                          SHA-256:89B74D2417EB27FEEA32B8666B08D28BC1FFE5DCF1652DBD8799F7555D79C71F
                                                                                                                                                                                                                          SHA-512:149FE725A3234A2F8C3EE1B03119440E3CB16586F04451B6E62CED0097B1AD227C97B55F5A66631033A888E860AB61CAF7DDD014696276BC9226D87F15164E2F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# safe.tcl --.#.# This file provide a safe loading/sourcing mechanism for safe interpreters..# It implements a virtual path mecanism to hide the real pathnames from the.# slave. It runs in a master interpreter and sets up data structure and.# aliases that will be invoked when used from a slave interpreter..#.# See the safe.n man page for details..#.# Copyright (c) 1996-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...#.# The implementation is based on namespaces. These naming conventions are.# followed:.# Private procs starts with uppercase..# Public procs are exported and starts with lowercase.#..# Needed utilities package.package require opt 0.4.1..# Create the safe namespace.namespace eval ::safe {. # Exported API:. namespace export interpCreate interpInit interpConfigure interpDelete \..interpAddToAccessPath interpFindInAccessPath setLogCmd.}..# Helper function to
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5415
                                                                                                                                                                                                                          Entropy (8bit):4.701682771925196
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:esataNULULUVUhU5U1UIUZUJeUpgURUFD15Q0AkU6PkrBkGUjZKspDzmK5SMFTub:eNtEACkiwM3g4ePOiD15Q0AkU6PkrBko
                                                                                                                                                                                                                          MD5:E127196E9174B429CC09C040158F6AAB
                                                                                                                                                                                                                          SHA1:FF850F5D1BD8EFC1A8CB765FE8221330F0C6C699
                                                                                                                                                                                                                          SHA-256:ABF7D9D1E86DE931096C21820BFA4FD70DB1F55005D2DB4AA674D86200867806
                                                                                                                                                                                                                          SHA-512:C4B98EBC65E25DF41E6B9A93E16E608CF309FA0AE712578EE4974D84F7F33BCF2A6ED7626E88A343350E13DA0C5C1A88E24A87FCBD44F7DA5983BB3EF036A162
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl autoload index file, version 2.0.# -*- tcl -*-.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(auto_reset) [list source [file join $dir auto.tcl]].set auto_index(tcl_findLibrary) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex) [list source [file join $dir auto.tcl]].set auto_index(auto_mkindex_old) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::init) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::cleanup) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::mkindex) [list source [file join $dir auto.tcl]].set auto_index(::auto_mkindex_parser::hook) [list source [file join $dir auto.tcl]].set auto_in
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11633
                                                                                                                                                                                                                          Entropy (8bit):4.706526847377957
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:CnjVD6gOGFpvXKPrzYkWo55z3ovPvKvaWZPZ9W6TV9ujpZw7K3mQ4auPltqQvu9:CGQvX+XYkn59YvPSvDJTV9174zuPltBC
                                                                                                                                                                                                                          MD5:F9ED2096EEA0F998C6701DB8309F95A6
                                                                                                                                                                                                                          SHA1:BCDB4F7E3DB3E2D78D25ED4E9231297465B45DB8
                                                                                                                                                                                                                          SHA-256:6437BD7040206D3F2DB734FA482B6E79C68BCC950FBA80C544C7F390BA158F9B
                                                                                                                                                                                                                          SHA-512:E4FB8F28DC72EA913F79CEDF5776788A0310608236D6607ADC441E7F3036D589FD2B31C446C187EF5827FD37DCAA26D9E94D802513E3BF3300E94DD939695B30
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# -*- tcl -*-.#.# Searching for Tcl Modules. Defines a procedure, declares it as the primary.# command for finding packages, however also uses the former 'package unknown'.# command as a fallback..#.# Locates all possible packages in a directory via a less restricted glob. The.# targeted directory is derived from the name of the requested package, i.e..# the TM scan will look only at directories which can contain the requested.# package. It will register all packages it found in the directory so that.# future requests have a higher chance of being fulfilled by the ifneeded.# database without having to come to us again..#.# We do not remember where we have been and simply rescan targeted directories.# when invoked again. The reasoning is this:.#.# - The only way we get back to the same directory is if someone is trying to.# [package require] something that wasn't there on the first scan..#.# Either.# 1) It is there now: If we rescan, you get it; if not you don't..#.# This co
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):141
                                                                                                                                                                                                                          Entropy (8bit):4.951583909886815
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52DcsG/kXGm2OHnFvpsYvUdSalHFLd:SlSWB9X52DBGTm2OHnFvmYValHf
                                                                                                                                                                                                                          MD5:6FB79707FD3A183F8A3C780CA2669D27
                                                                                                                                                                                                                          SHA1:E703AB552B4231827ACD7872364C36C70988E4C0
                                                                                                                                                                                                                          SHA-256:A5DC7BFB4F569361D438C8CF13A146CC2641A1A884ACF905BB51DA28FF29A900
                                                                                                                                                                                                                          SHA-512:CDD3AD9AFFD246F4DFC40C1699E368FB2924E73928060B1178D298DCDB11DBD0E88BC10ED2FED265F7F7271AC5CCE14A60D65205084E9249154B8D54C2309E52
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Abidjan) {. {-9223372036854775808 -968 0 LMT}. {-1830383032 0 0 GMT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1393
                                                                                                                                                                                                                          Entropy (8bit):3.9087586646312253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52DUsmdHvdDZxdCjFaEu3MEANKSgI3u2VuTSr0l+pU4Y4Y0gK:cQ9elDZxdCwEu3MEANKSgsrVkvY64Y4
                                                                                                                                                                                                                          MD5:FFEDB06126D6DA9F3BECA614428F51E9
                                                                                                                                                                                                                          SHA1:2C549D1CF8636541D42BDC56D8E534A222E4642C
                                                                                                                                                                                                                          SHA-256:567A0AD3D2C9E356A2E38A76AF4D5C4B8D5B950AF7B648A027FE816ACAE455AE
                                                                                                                                                                                                                          SHA-512:E057EA59A47C881C60B2196554C9B24C00CB26345CA7E311B5409F6FBB31EBEDD13C41A4C3B0B68AE8B93F4819158D94610DE795112E77209F391AC31332BA2A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Accra) {. {-9223372036854775808 -52 0 LMT}. {-1640995148 0 0 GMT}. {-1556841600 1200 1 GMT}. {-1546388400 0 0 GMT}. {-1525305600 1200 1 GMT}. {-1514852400 0 0 GMT}. {-1493769600 1200 1 GMT}. {-1483316400 0 0 GMT}. {-1462233600 1200 1 GMT}. {-1451780400 0 0 GMT}. {-1430611200 1200 1 GMT}. {-1420158000 0 0 GMT}. {-1399075200 1200 1 GMT}. {-1388622000 0 0 GMT}. {-1367539200 1200 1 GMT}. {-1357086000 0 0 GMT}. {-1336003200 1200 1 GMT}. {-1325550000 0 0 GMT}. {-1304380800 1200 1 GMT}. {-1293927600 0 0 GMT}. {-1272844800 1200 1 GMT}. {-1262391600 0 0 GMT}. {-1241308800 1200 1 GMT}. {-1230855600 0 0 GMT}. {-1209772800 1200 1 GMT}. {-1199319600 0 0 GMT}. {-1178150400 1200 1 GMT}. {-1167697200 0 0 GMT}. {-1146614400 1200 1 GMT}. {-1136161200 0 0 GMT}. {-1115078400 1200 1 GMT}. {-1104625200 0 0 GMT}. {-1083542400 1200 1 GMT}. {-1073
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.766991307890532
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DczqIVDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DnaDkr
                                                                                                                                                                                                                          MD5:C203A97FC500E408AC841A6A5B21E14E
                                                                                                                                                                                                                          SHA1:ED4C4AA578A16EB83220F37199460BFE207D2B44
                                                                                                                                                                                                                          SHA-256:3EBC66964609493524809AD0A730FFFF036C38D9AB3770412841F80DFFC717D5
                                                                                                                                                                                                                          SHA-512:2F1A4500F49AFD013BCA70089B1E24748D7E45D41F2C9D3D9AFDCC1778E750FFB020D34F622B071E80F80CC0FEFF080E8ACC1E7A8ABE8AD12C0F1A1DAA937FE5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Addis_Ababa) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1041
                                                                                                                                                                                                                          Entropy (8bit):4.110061823095588
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52D7AmdHh5PMybVSqSFvvqXFaLSaSxmvWo/fmvCkQ6eW6Xs8QQB1r5Q:cQIefMyb8BF6XFaLSxktf1PW6X4q1K
                                                                                                                                                                                                                          MD5:8221A83520B1D3DE02E886CFB1948DE3
                                                                                                                                                                                                                          SHA1:0806A0898FDE6F5AE502C64515A1345D71B1F7D2
                                                                                                                                                                                                                          SHA-256:5EE3B25676E813D89ED866D03B5C3388567D8307A2A60D1C4A34D938CBADF710
                                                                                                                                                                                                                          SHA-512:2B8A837F7CF6DE43DF4072BF4A54226235DA8B8CA78EF55649C7BF133B2E002C614FE7C693004E3B17C25FBCECAAD5CD9B0A8CB0A5D32ADF68EA019203EE8704
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Algiers) {. {-9223372036854775808 732 0 LMT}. {-2486679072 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1531443600 0 0 WET}. {-956365200 3600 1 WEST}. {-950486400 0 0 WET}. {-942012000 3600 0 CET}. {-812502000 7200 1 CEST}. {-796262400 3600 0 CET}. {-781052400 7200 1 CEST}. {-766630800 3600 0 CET}. {-733280400 0 0 WET}. {-439430400 3600 0 CET}. {-212029200 0 0 WET}. {41468400 3600 1 WEST}. {54774000 0 0 WET}. {231724800 3600 1 WEST}. {246240000 3600 0 CET}. {259545600 7200 1 CEST}. {275274000 3600 0 CET}. {309740400 0 0 WET}. {325468800 3600 1 WEST}. {3418020
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.750118730136804
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcjEUEH+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DGs+Dkr
                                                                                                                                                                                                                          MD5:F8CEC826666174899C038EC9869576ED
                                                                                                                                                                                                                          SHA1:4CAA32BB070F31BE919F5A03141711DB22072E2C
                                                                                                                                                                                                                          SHA-256:D9C940B3BE2F9E424BC6F69D665C21FBCA7F33789E1FE1D27312C0B38B75E097
                                                                                                                                                                                                                          SHA-512:DA890F5A6806AE6774CFC061DFD4AE069F78212AB063287146245692383022AABB3637DEB49C1D512DA3499DC4295541962DAC05729302B3314E7BF306E6CB41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Asmara) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.755468133981916
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcjAWDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2D8Dkr
                                                                                                                                                                                                                          MD5:8B5DCBBDB2309381EAA8488E1551655F
                                                                                                                                                                                                                          SHA1:65065868620113F759C5D37B89843A334E64D210
                                                                                                                                                                                                                          SHA-256:F7C8CEE9FA2A4BF9F41ABA18010236AC4CCD914ACCA9E568C87EDA0503D54014
                                                                                                                                                                                                                          SHA-512:B8E61E6D5057CD75D178B292CD19CBCED2A127099D95046A7448438BCC035DE4066FDD637E9055AC3914E4A8EAA1B0123FA0E90E4F7042B2C4551BB009F1D2E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Asmera) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.83500517532947
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcxAQDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DwNDBP
                                                                                                                                                                                                                          MD5:FCBE668127DFD81CB0F730C878EB2F1A
                                                                                                                                                                                                                          SHA1:F27C9D96A04A12AC7423A60A756732B360D6847D
                                                                                                                                                                                                                          SHA-256:6F462C2C5E190EFCA68E882CD61D5F3A8EF4890761376F22E9905B1B1B6FDE9F
                                                                                                                                                                                                                          SHA-512:B0E6E4F5B46A84C2D02A0519831B98F336AA79079FF2CB9F290D782335FB4FB39A3453520424ED3761D801B9FBE39228B1D045C40EDD70B29801C26592F9805A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Bamako) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.834042129935993
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcx2m/2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dw/2D4v
                                                                                                                                                                                                                          MD5:7A017656AB8048BD67250207CA265717
                                                                                                                                                                                                                          SHA1:F2BB86BC7B7AB886738A33ADA37C444D6873DB94
                                                                                                                                                                                                                          SHA-256:E31F69E16450B91D79798C1064FEA18DE89D5FE343D2DE4A5190BCF15225E69D
                                                                                                                                                                                                                          SHA-512:695FA7369341F1F4BC1B629CDAB1666BEFE2E7DB32D75E5038DC17526A3CCE293DB36AFEB0955B06F5834D43AEF140F7A66EC52598444DBE8C8B70429DBE5FC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Bangui) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.839691887198201
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcx79FHp4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dw7J4V
                                                                                                                                                                                                                          MD5:149DD4375235B088386A2D187ED03FFB
                                                                                                                                                                                                                          SHA1:5E879B778E2AB110AC7815D3D62A607A76AAB93B
                                                                                                                                                                                                                          SHA-256:1769E15721DAFF477E655FF7A8491F4954FB2F71496287C6F9ED265FE5588E00
                                                                                                                                                                                                                          SHA-512:4F997EDE6F04A89240E0950D605BB43D6814DCCA433F3A75F330FA13EE8729A10D20E9A0AAD6E6912370E350ABD5A65B878B914FCC9A5CA8503E3A5485E57B3E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Banjul) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):169
                                                                                                                                                                                                                          Entropy (8bit):4.797400281087303
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52Dc5ixXGm2OHGVkevUdSaw7FFFkhSVPVFd:SlSWB9X52D4fm2OHCkeVawBFF2mh
                                                                                                                                                                                                                          MD5:BA4959590575031330280A4ADC7017D1
                                                                                                                                                                                                                          SHA1:34FBC2AFD2E13575D286062050D98ABC4BF7C7A6
                                                                                                                                                                                                                          SHA-256:2C06A94A43AC7F0079E6FE371F0D5A06A7BF23A868AC3B10135BFC4266CD2D4E
                                                                                                                                                                                                                          SHA-512:65E6161CB6AF053B53C7ABE1E4CAAD4F40E350D52BADCB95EB37138268D17CF48DDB0CA771F450ECD8E6A57C99BE2E8C2227A28B5C4AF3DE7F6D74F255118F04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Bissau) {. {-9223372036854775808 -3740 0 LMT}. {-1830380400 -3600 0 -01}. {157770000 0 0 GMT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.856245693637169
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62Dc8ycXp75h4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DAmp1T
                                                                                                                                                                                                                          MD5:3F6E187410D0109D05410EFC727FB5E5
                                                                                                                                                                                                                          SHA1:CAB54D985823218E01EDF9165CABAB7A984EE93E
                                                                                                                                                                                                                          SHA-256:9B2EEB0EF36F851349E254E1745D11B65CB30A16A2EE4A87004765688A5E0452
                                                                                                                                                                                                                          SHA-512:E12D6DBEA8DE9E3FB236011B962FFE1AEB95E3353B13303C343565B60AA664508D51A011C66C3CE2460C52A901495F46D0500C9B74E19399AE66231E5D6200A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Blantyre) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.853052123353996
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DciE0TMJZp4DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2D4qGp4e
                                                                                                                                                                                                                          MD5:4F5159996C16A171D9B011C79FDDBF63
                                                                                                                                                                                                                          SHA1:51BCA6487762E42528C845CCA33173B3ED707B3F
                                                                                                                                                                                                                          SHA-256:E73ADC4283ECA7D8504ABC6CB28D98EB071ED867F77DE9FADA777181533AD1D0
                                                                                                                                                                                                                          SHA-512:6E5D4DF903968395DFDB834FBD4B2A0294E945A9939D05BED8533674EA0ACE8393731DDCDFACF7F2C9A00D38DC8F5EDB173B4025CF05122B0927829D07ED203F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Brazzaville) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.900915013374923
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DclbDcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DkbDE/
                                                                                                                                                                                                                          MD5:9E81B383C593422481B5066CF23B8CE1
                                                                                                                                                                                                                          SHA1:8DD0408272CBE6DF1D5051CB4D9319B5A1BD770E
                                                                                                                                                                                                                          SHA-256:9ADCD7CB6309049979ABF8D128C1D1BA35A02F405DB8DA8C39D474E8FA675E38
                                                                                                                                                                                                                          SHA-512:9939ED703EC26350DE9CC59BF7A8C76B6B3FE3C67E47CCDDE86D87870711224ADEEC61D93AC7926905351B8333AD01FF235276A5AB766474B5884F8A0329C2CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Bujumbura) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3720
                                                                                                                                                                                                                          Entropy (8bit):3.687670811431724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5hRg1oCSY0WF6yU0yWZVYbZ0F0ZeTvc0jDlSBFX84aKqITVuV09ONWHr0L0335Kw:Fu0oVy0FUeLIvQV8c0OvOakCUUO
                                                                                                                                                                                                                          MD5:1B38D083FC54E17D82935D400051F571
                                                                                                                                                                                                                          SHA1:AE34C08176094F4C4BFEB4E1BBAE6034BCD03A11
                                                                                                                                                                                                                          SHA-256:11283B69DE0D02EAB1ECF78392E3A4B32288CCFEF946F0432EC83327A51AEDDC
                                                                                                                                                                                                                          SHA-512:581161079EC0F77EEB119C96879FD586AE49997BAD2C5124C360BCACF9136FF0A6AD70AE7D4C88F96BC94EEB87F628E8890E65DB9B0C96017659058D35436307
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Cairo) {. {-9223372036854775808 7509 0 LMT}. {-2185409109 7200 0 EET}. {-929844000 10800 1 EEST}. {-923108400 7200 0 EET}. {-906170400 10800 1 EEST}. {-892868400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857790000 7200 0 EET}. {-844308000 10800 1 EEST}. {-825822000 7200 0 EET}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EET}. {-779853600 10800 1 EEST}. {-762663600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 72
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1567
                                                                                                                                                                                                                          Entropy (8bit):3.593430930151928
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5qSFbS4PUuMfMSAdZXfSGjX6JAzS26WZrW0SKQYXRWXpSjv:YmG0HZPcOQy1p
                                                                                                                                                                                                                          MD5:9DB3A6EB1162C5D814B98265FB58D004
                                                                                                                                                                                                                          SHA1:63ACAD6C18B49EF6794610ADED9865C8600A4D5C
                                                                                                                                                                                                                          SHA-256:EF30CFFD1285339F4CC1B655CB4CB8C5D864C4B575D66F18919A35C084AA4E5F
                                                                                                                                                                                                                          SHA-512:0581F6640BDDD8C33E82983F2186EB0952946C70A4B3F524EC78D1BE3EC1FA10BC3672A99CBA3475B28C0798D62A14F298207160F04EE0861EDDA352DA2BCCA0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Casablanca) {. {-9223372036854775808 -1820 0 LMT}. {-1773012580 0 0 +00}. {-956361600 3600 1 +00}. {-950490000 0 0 +00}. {-942019200 3600 1 +00}. {-761187600 0 0 +00}. {-617241600 3600 1 +00}. {-605149200 0 0 +00}. {-81432000 3600 1 +00}. {-71110800 0 0 +00}. {141264000 3600 1 +00}. {147222000 0 0 +00}. {199756800 3600 1 +00}. {207702000 0 0 +00}. {231292800 3600 1 +00}. {244249200 0 0 +00}. {265507200 3600 1 +00}. {271033200 0 0 +00}. {448243200 3600 0 +01}. {504918000 0 0 +00}. {1212278400 3600 1 +00}. {1220223600 0 0 +00}. {1243814400 3600 1 +00}. {1250809200 0 0 +00}. {1272758400 3600 1 +00}. {1281222000 0 0 +00}. {1301788800 3600 1 +00}. {1312066800 0 0 +00}. {1335664800 3600 1 +00}. {1342749600 0 0 +00}. {1345428000 3600 1 +00}. {1348970400 0 0 +00}. {1367114400 3600 1 +00}. {1373162400 0 0 +00}. {1376100000 3600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7277
                                                                                                                                                                                                                          Entropy (8bit):3.744402699283941
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:/N8d9VA1URbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:/AHAiRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:261E339A2575F28099CD783B52F0980C
                                                                                                                                                                                                                          SHA1:F7EB8B3DAE9C07382D5123225B3EAA4B5BFD47D6
                                                                                                                                                                                                                          SHA-256:9C7D0E75AFC5681579D1018D7259733473EEDFFAF7313016B60159CB2A4DCAB5
                                                                                                                                                                                                                          SHA-512:8E622174CB6DB4D0172DBC2E408867F03EBB7D1D54AA51D99C4465945CFF369AAFAF17D1D0F9277E69CBE3AD6AAF9A0C6EE056017474DF171E94BD28BBA9C04A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ceuta) {. {-9223372036854775808 -1276 0 LMT}. {-2177452800 0 0 WET}. {-1630112400 3600 1 WEST}. {-1616810400 0 0 WET}. {-1451692800 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427673600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316390400 3600 1 WEST}. {-1301270400 0 0 WET}. {-1293840000 0 0 WET}. {-94694400 0 0 WET}. {-81432000 3600 1 WEST}. {-71110800 0 0 WET}. {141264000 3600 1 WEST}. {147222000 0 0 WET}. {199756800 3600 1 WEST}. {207702000 0 0 WET}. {231292800 3600 1 WEST}. {244249200 0 0 WET}. {265507200 3600 1 WEST}. {271033200 0 0 WET}. {448243200 3600 0 CET}. {504918000 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.832452688412801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcmMM1+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DCM1+V
                                                                                                                                                                                                                          MD5:DC007D4B9C02AAD2DBD48E73624B893E
                                                                                                                                                                                                                          SHA1:9BEE9D21566D6C6D4873EFF9429AE3D3F85BA4E4
                                                                                                                                                                                                                          SHA-256:3BF37836C9358EC0ABD9691D8F59E69E8F6084A133A50650239890C458D4AA41
                                                                                                                                                                                                                          SHA-512:45D3BC383A33F7079A6D04079112FD73DB2DDBB7F81BFF8172FABCAA949684DC31C8B156E647F77AF8BA26581D3812D510C250CDC4D7EEEC788DDB2B77CD47E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Conakry) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.8075658510312484
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcXXMFBx/2DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DKXEB4
                                                                                                                                                                                                                          MD5:CDA180DB8DF825268DB06298815C96F0
                                                                                                                                                                                                                          SHA1:20B082082CFA0DF49C0DF4FD698EBD061280A2BB
                                                                                                                                                                                                                          SHA-256:95D31A4B3D9D9977CBDDD55275492A5A954F431B1FD1442C519255FBC0DBA615
                                                                                                                                                                                                                          SHA-512:2D35698DE3BF1E90AB37C84ED4E3D0B57F02555A8AEB98659717EEC1D5EED17044D446E12B5AAC12A9721A3F9667343C5CACD7AB00BF986285B8084FF9384654
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Dakar) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):4.795449330458551
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2Dc8bEH+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DJbVDkr
                                                                                                                                                                                                                          MD5:AF8E3E86312E3A789B82CECEDDB019CE
                                                                                                                                                                                                                          SHA1:6B353BAB18E897151BF274D6ACF410CDFF6F00F0
                                                                                                                                                                                                                          SHA-256:F39E4CABE33629365C2CEF6037871D698B942F0672F753212D768E865480B822
                                                                                                                                                                                                                          SHA-512:9891AA26C4321DD5C4A9466F2EE84B14F18D3FFD71D6E8D2DE5CAFE4DC563D85A934B7B4E55926B30181761EF8C9B6C97746F522718BAE9DCBE4BDDE70C42B53
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Dar_es_Salaam) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.779330261863059
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcRHKQ1BQDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DOrkDkr
                                                                                                                                                                                                                          MD5:1440C37011F8F31213AE5833A3FCD5E1
                                                                                                                                                                                                                          SHA1:9EEE9D7BB3A1E29EDDE90D7DBE63ED50513A909B
                                                                                                                                                                                                                          SHA-256:A4E0E775206EDBA439A454649A7AC94AE3AFEADC8717CBD47FD7B8AC41ADB06F
                                                                                                                                                                                                                          SHA-512:D82FF9C46C8845A6F15DC96AF8D98866C601EF0B4F7F5F0260AD571DD46931E90443FFEB5910D5805C5A43F6CC8866116066565646AE2C96E1D260999D1641F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Djibouti) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.800219030063992
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcnKe2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dml2D4v
                                                                                                                                                                                                                          MD5:18C0C9E9D5154E20CC9301D5012066B9
                                                                                                                                                                                                                          SHA1:8395E917261467EC5C27034C980EDD05F2242F40
                                                                                                                                                                                                                          SHA-256:0595C402B8499FC1B67C196BEE24BCA4DE14D3E10B8DBBD2840D2B4C88D9DF28
                                                                                                                                                                                                                          SHA-512:C53540E25B76DF8EC3E2A5F27B473F1D6615BFBD043E133867F3391B057D8552350F912DF55DD11C1357765EF76D8E286BBBE839F28295D09751243DC0201BDF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Douala) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1281
                                                                                                                                                                                                                          Entropy (8bit):3.6551425401331312
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQbe5T7pkNUSMSA7ZXgUSGjX6JAWqS26WZrW0SKQYJZRWXpSjv:5opMfMSA7ZXfSGjX6JAzS26WZrW0SKQm
                                                                                                                                                                                                                          MD5:8E9FF3CB18879B1C69A04F45715D24BB
                                                                                                                                                                                                                          SHA1:EF391BF1C3E1DEC08D8158B82B2FB0ED3E69866E
                                                                                                                                                                                                                          SHA-256:A6CFC4359B7E2D650B1851D805FF5CD4562D0D1253793EA0978819B9A2FCC0E2
                                                                                                                                                                                                                          SHA-512:6BFF03EE8973E2204181967987930EECDD39789DB353DB2EFC786027A8013CFF4835FAB9E3F0AF935D2A2D49CCEBE565FD481BA230EDF4D22A7848D4781C877C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/El_Aaiun) {. {-9223372036854775808 -3168 0 LMT}. {-1136070432 -3600 0 -01}. {198291600 0 0 +00}. {199756800 3600 1 +00}. {207702000 0 0 +00}. {231292800 3600 1 +00}. {244249200 0 0 +00}. {265507200 3600 1 +00}. {271033200 0 0 +00}. {1212278400 3600 1 +00}. {1220223600 0 0 +00}. {1243814400 3600 1 +00}. {1250809200 0 0 +00}. {1272758400 3600 1 +00}. {1281222000 0 0 +00}. {1301788800 3600 1 +00}. {1312066800 0 0 +00}. {1335664800 3600 1 +00}. {1342749600 0 0 +00}. {1345428000 3600 1 +00}. {1348970400 0 0 +00}. {1367114400 3600 1 +00}. {1373162400 0 0 +00}. {1376100000 3600 1 +00}. {1382839200 0 0 +00}. {1396144800 3600 1 +00}. {1403920800 0 0 +00}. {1406944800 3600 1 +00}. {1414288800 0 0 +00}. {1427594400 3600 1 +00}. {1434247200 0 0 +00}. {1437271200 3600 1 +00}. {1445738400 0 0 +00}. {1459044000 3600 1 +00}. {146509200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.817633094200984
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcu5sp4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dk4DBP
                                                                                                                                                                                                                          MD5:035B36DF91F67179C8696158F58D0CE8
                                                                                                                                                                                                                          SHA1:E43BFF33090324110048AC19CBA16C4ED8D8B3FE
                                                                                                                                                                                                                          SHA-256:3101942D9F3B2E852C1D1EA7ED85826AB9EA0F8953B9A0E6BAC32818A2EC9EDD
                                                                                                                                                                                                                          SHA-512:A7B52154C6085E5D234D6D658BA48D2C8EC093A429C3907BE7D16654F6EE9EBE8E3100187650956E5164B18340AB0C0979C1F4FA90EFE0CC423FBA5F14F45215
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Freetown) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.8512443534123255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcHK0o/4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DAV+4G
                                                                                                                                                                                                                          MD5:BA2C7443CFCB3E29DB84FEC16B3B3843
                                                                                                                                                                                                                          SHA1:2BA7D68C48A79000B1C27588A20A751AA04C5779
                                                                                                                                                                                                                          SHA-256:28C1453496C2604AA5C42A88A060157BDFE22F28EDD1FBC7CC63B02324ED8445
                                                                                                                                                                                                                          SHA-512:B275ABAADA7352D303EFEAD66D897BE3099A33B80EA849F9F1D98D522AA9A3DC44E1D979C0ABF2D7886BACF2F86D25837C971ECE6B2AF731BE2EE0363939CBDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Gaborone) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.835896095919456
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62Dc0B5h4DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62Dlfh4G
                                                                                                                                                                                                                          MD5:59137CFDB8E4B48599FB417E0D8A4A70
                                                                                                                                                                                                                          SHA1:F13F9932C0445911E395377FB51B859E4F72862A
                                                                                                                                                                                                                          SHA-256:E633C6B619782DA7C21D548E06E6C46A845033936346506EA0F2D4CCCDA46028
                                                                                                                                                                                                                          SHA-512:2DCEB9A9FA59512ADCDE4946F055718A8C8236A912F6D521087FC348D52FFF462B5712633FDA5505876C500F5FD472381B3AC90CF1AEDF0C96EA08E0A0D3B7BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Harare) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):298
                                                                                                                                                                                                                          Entropy (8bit):4.638948195674004
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52DWbAm2OHePP1mXs0//HF20706VcF206KsF:MBp52DWkmdHePP1mcUvFxJVcFEKsF
                                                                                                                                                                                                                          MD5:256740512DCB35B4743D05CC24C636DB
                                                                                                                                                                                                                          SHA1:1FD418712B3D7191549BC0808CF180A682AF7FC1
                                                                                                                                                                                                                          SHA-256:768E9B2D9BE96295C35120414522FA6DD3EDA4500FE86B6D398AD452CAF6FA4B
                                                                                                                                                                                                                          SHA-512:DCFF6C02D1328297BE24E0A640F5823BFD23BDE67047671AC18EB0B1F450C717E273B27A48857F54A18D6877AB8132AAED94B2D87D2F962DA43FE473FC3DDC94
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Johannesburg) {. {-9223372036854775808 6720 0 LMT}. {-2458173120 5400 0 SAST}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {-829526400 10800 1 SAST}. {-813805200 7200 0 SAST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1059
                                                                                                                                                                                                                          Entropy (8bit):3.9545766161038602
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQresZkn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8Wb2:5on010ilux1XeKXhCvN9U0TMGqCp8jYH
                                                                                                                                                                                                                          MD5:79FCA072C6AABA65FB2DC83F33BFA17E
                                                                                                                                                                                                                          SHA1:AC86AA9B0EAACAB1E4FDB14AECD8D884F8329A5A
                                                                                                                                                                                                                          SHA-256:C084565CC6C217147C00DCA7D885AC917CFC8AF4A33CBA146F28586AD6F9832C
                                                                                                                                                                                                                          SHA-512:9F19DEA8E21CE3D3DCA0AFC5588203DBB6F5A13BBE10CFDA0CEBE4A417384B85DB3BFFC48687EF7AD27268715FC154E235C106EC91875BA646C6759D285F1027
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Juba) {. {-9223372036854775808 7588 0 LMT}. {-1230775588 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1 CAST
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.787605387034664
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcJEl2DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DIEl2Dkr
                                                                                                                                                                                                                          MD5:8CF1CA04CD5FC03D3D96DC49E98D42D4
                                                                                                                                                                                                                          SHA1:4D326475E9216089C872D5716C54DEB94590FCDE
                                                                                                                                                                                                                          SHA-256:A166E17E3A4AB7C5B2425A17F905484EBFDBA971F88A221155BCA1EC5D28EA96
                                                                                                                                                                                                                          SHA-512:1301B9469ED396198A2B87CBA254C66B148036C0117D7D4A8286CB8729296AD735DF16581AEF0715CEE24213E91970F181824F3A64BCF91435FDAD85DCD78C84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Kampala) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1091
                                                                                                                                                                                                                          Entropy (8bit):3.9616554773567083
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQWe9hXn0Vb0iluy8pLXeKXhCvN9U0TlW50qCPR8jYJRFp0Q8SdAri/8+u8WbVgM:5vn010ilux1XeKXhCvN9U0TMGqCp8jYs
                                                                                                                                                                                                                          MD5:A00B0C499DE60158C9990CFE9628FEA4
                                                                                                                                                                                                                          SHA1:44B768C63E170331396B4B81ABF0E3EDD8B0D864
                                                                                                                                                                                                                          SHA-256:FCFF440D525F3493447C0ACFE32BB1E8BCDF3F1A20ADC3E0F5D2B245E2DB10E9
                                                                                                                                                                                                                          SHA-512:30BF22857AA4C26FC6178C950AB6EAB472F2AC77D2D8EB3A209DCDEF2DDC8312B0AB6DA3428936CA16225ABE652DDB8536D870DB1905027AD7BD7FF245871556
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Khartoum) {. {-9223372036854775808 7808 0 LMT}. {-1230775808 7200 0 CAT}. {10360800 10800 1 CAST}. {24786000 7200 0 CAT}. {41810400 10800 1 CAST}. {56322000 7200 0 CAT}. {73432800 10800 1 CAST}. {87944400 7200 0 CAT}. {104882400 10800 1 CAST}. {119480400 7200 0 CAT}. {136332000 10800 1 CAST}. {151016400 7200 0 CAT}. {167781600 10800 1 CAST}. {182552400 7200 0 CAT}. {199231200 10800 1 CAST}. {214174800 7200 0 CAT}. {230680800 10800 1 CAST}. {245710800 7200 0 CAT}. {262735200 10800 1 CAST}. {277246800 7200 0 CAT}. {294184800 10800 1 CAST}. {308782800 7200 0 CAT}. {325634400 10800 1 CAST}. {340405200 7200 0 CAT}. {357084000 10800 1 CAST}. {371941200 7200 0 CAT}. {388533600 10800 1 CAST}. {403477200 7200 0 CAT}. {419983200 10800 1 CAST}. {435013200 7200 0 CAT}. {452037600 10800 1 CAST}. {466635600 7200 0 CAT}. {483487200 10800 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.8623059127375585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcCJRx+DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DRX+Da
                                                                                                                                                                                                                          MD5:32AE0D7A7E7F0DF7AD0054E959A53B09
                                                                                                                                                                                                                          SHA1:AE455C96401EBB1B2BDE5674A71A182D9E12D7BD
                                                                                                                                                                                                                          SHA-256:7273FA039D250CABAE2ACCE926AB483B0BF16B0D77B9C2A7B499B9BDFB9E1CBB
                                                                                                                                                                                                                          SHA-512:DC8E89A75D7212D398A253E6FF3D10AF72B7E14CBC07CA53C6CB01C8CE40FB12375E50AD4291C973C872566F8D875D1E1A2CF0A38F02C91355B957095004563E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Kigali) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.816805447465336
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcqQFeDcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DdD4v
                                                                                                                                                                                                                          MD5:90EC372D6C8677249C8C2841432F0FB7
                                                                                                                                                                                                                          SHA1:5D5E549496962420F56897BC01887B09EC863D78
                                                                                                                                                                                                                          SHA-256:56F7CA006294049FA92704EDEAD78669C1E9EABE007C41F722E972BE2FD58A37
                                                                                                                                                                                                                          SHA-512:93FD7C8F5C6527DCCFBF21043AB5EED21862A22DA1FDB3ED7635723060C9252D76541DAD3A76EBF8C581A82A6DBEF2766DD428ACE3A9D6A45954A787B686B1CA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Kinshasa) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):141
                                                                                                                                                                                                                          Entropy (8bit):4.965079502032549
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52DcGemFFkXGm2OHWTdvUQDWTFWZRYvCn:SlSWB9X52D4mFJm2OHWTdRDWTGRLn
                                                                                                                                                                                                                          MD5:51D7AC832AE95CFDE6098FFA6FA2B1C7
                                                                                                                                                                                                                          SHA1:9DA61FDA03B4EFDA7ACC3F83E8AB9495706CCEF1
                                                                                                                                                                                                                          SHA-256:EEDA5B96968552C12B916B39217005BF773A99CA17996893BC87BCC09966B954
                                                                                                                                                                                                                          SHA-512:128C8D3A0AA7CF4DFAE326253F236058115028474BF122F14AB9461D910A03252FEEB420014CA91ACFBF94DF05FBFCADE98217FC59A86A2581BB68CDC83E88C8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Lagos) {. {-9223372036854775808 816 0 LMT}. {-1588464816 3600 0 WAT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.816649832558406
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcr7bp4DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dgfp4Di
                                                                                                                                                                                                                          MD5:D1387B464CFCFE6CB2E10BA82D4EEE0E
                                                                                                                                                                                                                          SHA1:F672B694551AB4228D4FC938D0CC2DA635EB8878
                                                                                                                                                                                                                          SHA-256:BEE63E4DF9D03D2F5E4100D0FCF4E6D555173083A4470540D4ADC848B788A2FC
                                                                                                                                                                                                                          SHA-512:DEB95AAB852772253B60F83DA9CE5E24144386DFBFB1F1E9A77905511181EC84FD13B00200602D6C276820527206EE0078DDE81CC0F1B1276B8BF4360C2CDB1E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Libreville) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.813464796454866
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2Dcih4DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DNh4DB
                                                                                                                                                                                                                          MD5:D2AA823E78DD8E0A0C83508B6378DE5D
                                                                                                                                                                                                                          SHA1:C26E03EF84C3C0B6001F0D4471907A94154E6850
                                                                                                                                                                                                                          SHA-256:345F3F9422981CC1591FBC1B5B17A96F2F00F0C191DF23582328D44158041CF0
                                                                                                                                                                                                                          SHA-512:908F8D096DA6A336703E7601D03477CECBCDC8D404C2410C7F419986379A14943BB61B0D92D87160D5F1EF5B229971B2B9D122D2B3F70746CED0D4D6B10D7412
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Lome) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.807298951345495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DccLtBQDcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DXQD4v
                                                                                                                                                                                                                          MD5:E851465BCA70F325B0B07E782D6A759E
                                                                                                                                                                                                                          SHA1:3B3E0F3FD7AF99F941A3C70A2A2564C9301C8CFB
                                                                                                                                                                                                                          SHA-256:F7E1DCBAE881B199F2E2BF18754E145DDED230518C691E7CB34DAE3C922A6063
                                                                                                                                                                                                                          SHA-512:5F655B45D7A16213CE911EDAD935C1FEE7A947C0F5157CE20712A00B2A12A34AE51D5C05A392D2FF3A0B2DA7787D6C614FF100DDE7788CA01AAE21F10DD1CC3A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Luanda) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.893308860167744
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcfpT0DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62D8pT0G
                                                                                                                                                                                                                          MD5:CD638B7929FB8C474293D5ECF1FE94D3
                                                                                                                                                                                                                          SHA1:149AD0F3CF8AC1795E84B97CFF5CEB1FD26449C4
                                                                                                                                                                                                                          SHA-256:41D32824F28AE235661EE0C959E0F555C44E3E78604D6D2809BBA2254FD47258
                                                                                                                                                                                                                          SHA-512:D762C49B13961A01526C0DD9D7A55E202448E1B46BA64F701FB2E0ABE0F44B2C3DF743864B9E62DC07FD6CEA7197945CE246C89CDACB1FEC0F924F3ECC46B170
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Lubumbashi) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.857012096036922
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsfKGyVAIgNGEjKKW62DcOf+DcfKu:SlSWB9IZaM3y7fYVAIgNTj5W62DkDE/
                                                                                                                                                                                                                          MD5:3769866ADC24DA6F46996E43079C3545
                                                                                                                                                                                                                          SHA1:546FA9C76A1AE5C6763B31FC7214B8A2B18C3C52
                                                                                                                                                                                                                          SHA-256:5BAF390EA1CE95227F586423523377BABD141F0B5D4C31C6641E59C6E29FFAE0
                                                                                                                                                                                                                          SHA-512:DEA8CAB330F6321AD9444DB9FEC58E2CBCC79404B9E5539EABB52DBC9C3AC01BA1E8A3E1EC32906F02E4E4744271D84B626A5C32A8CD8B22210C42DD0E774A9C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Maputo)]} {. LoadTimeZoneFile Africa/Maputo.}.set TZData(:Africa/Lusaka) $TZData(:Africa/Maputo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.807416212132411
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2Dcn2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2D42D4v
                                                                                                                                                                                                                          MD5:37C13E1D11C817BA70DDC84E768F8891
                                                                                                                                                                                                                          SHA1:0765A45CC37EB71F4A5D2B8D3359AEE554C647FF
                                                                                                                                                                                                                          SHA-256:8F4F0E1C85A33E80BF7C04CF7E0574A1D829141CC949D2E38BDCC174337C5BAE
                                                                                                                                                                                                                          SHA-512:1E31BBA68E85A8603FBDD27DA68382CBC6B0E1AB0763E86516D3EFD15CFF106DE02812756F504AEE799BF6742423DF5732352D488B3F05B889BE5E48594F558D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Malabo) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):4.906945970372021
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52DcfKUXGm2OHoVvXdSF2iv:SlSWB9X52DESm2OHoVPdM
                                                                                                                                                                                                                          MD5:5497C01E507E7C392944946FCD984852
                                                                                                                                                                                                                          SHA1:4C3FD215E931CE36FF095DD9D23165340D6EECFE
                                                                                                                                                                                                                          SHA-256:C87A6E7B3B84CFFA4856C4B6C37C5C8BA5BBB339BDDCD9D2FD34CF17E5553F5D
                                                                                                                                                                                                                          SHA-512:83A2AA0ED1EB22056FFD3A847FB63DD09302DA213FE3AB660C41229795012035B5EA64A3236D3871285A8E271458C2DA6FCD599E5747F2F842E742C11222671A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Maputo) {. {-9223372036854775808 7820 0 LMT}. {-2109291020 7200 0 CAT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):194
                                                                                                                                                                                                                          Entropy (8bit):4.91873415322653
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7HbsvFVAIgNTzbDJL2DZQs+DWbBn:MBaIMaHw4NHnJL2DZiDWt
                                                                                                                                                                                                                          MD5:71A4197C8062BBFCCC62DCEFA87A25F9
                                                                                                                                                                                                                          SHA1:7490FAA5A0F5F20F456E71CBF51AA6DEB1F1ACC8
                                                                                                                                                                                                                          SHA-256:4B33414E2B59E07028E9742FA4AE34D28C08FD074DDC6084EDB1DD179198B3C1
                                                                                                                                                                                                                          SHA-512:A71CCB957FB5102D493320F48C94ADB642CCAA5F7F28BDDE05D1BB175C29BCBAC4D19DBC481AC0C80CE48F8E3840746C126CBC9CE511CA48D4E53DE22B3D66E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Johannesburg)]} {. LoadTimeZoneFile Africa/Johannesburg.}.set TZData(:Africa/Maseru) $TZData(:Africa/Johannesburg).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):195
                                                                                                                                                                                                                          Entropy (8bit):4.911369740193625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7HbsvFVAIgNTzbDJL2DzjEHp4DWbBn:MBaIMaHw4NHnJL2DzjEJ4DWt
                                                                                                                                                                                                                          MD5:8F4C02CE326FAEEBD926F94B693BFF9E
                                                                                                                                                                                                                          SHA1:9E8ABB12E4CFE341F24F5B050C75DDE3D8D0CB53
                                                                                                                                                                                                                          SHA-256:029AD8C75A779AED71FD233263643DADE6DF878530C47CF140FC8B7755DDA616
                                                                                                                                                                                                                          SHA-512:4B7D2D1D8DA876ABCD1E44FD5E4C992287F2B62B7C7BC3D6FD353E6312053F6762DBD11C0F27056EF8E37C8A2AF8E5111CF09D4EB6BB32EC1FF77F4C0C37917B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Johannesburg)]} {. LoadTimeZoneFile Africa/Johannesburg.}.set TZData(:Africa/Mbabane) $TZData(:Africa/Johannesburg).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.828470940863702
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt2DcBEBXCEeDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL2DFSVDkr
                                                                                                                                                                                                                          MD5:B686E9408AB6EC58F3301D954A068C7E
                                                                                                                                                                                                                          SHA1:C1259C31F93EB776F0F401920F076F162F3FFB2D
                                                                                                                                                                                                                          SHA-256:79DB89294DAE09C215B9F71C61906E49AFAA5F5F27B4BC5B065992A45B2C183D
                                                                                                                                                                                                                          SHA-512:CF96C687D33E68EB498A63EC262FC968858504410F670C6F492532F7C22F507BEACD41888B0A7527C30974DC545CCA9C015898E2D7C0C6D14C14C88F8BBED5C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Africa/Mogadishu) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200
                                                                                                                                                                                                                          Entropy (8bit):4.81604007062907
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52D3NwTm2OHrFGxYPlHIgafTwG5B:MBp52D3NwTmdHhmYPdIgar5B
                                                                                                                                                                                                                          MD5:8F9D1916FF86E2F8C5C9D4ABCC405D53
                                                                                                                                                                                                                          SHA1:286BFEC8F7CE6729F84FD6CFEE6A40B7277A4DFF
                                                                                                                                                                                                                          SHA-256:182F2608422FF14C53DC8AC1EDFFE054AE011275C1B5C2423E286AD95910F44C
                                                                                                                                                                                                                          SHA-512:7EEF6840E54313EF1127694F550986BF97BB1C8BD51DED0AB6D5842B74B5BF0406C65B293F1106E69DDFA0B01AD46756492DEDD9ECCBD077BB75FDA95A9E1912
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Monrovia) {. {-9223372036854775808 -2588 0 LMT}. {-2776979812 -2588 0 MMT}. {-1604359012 -2670 0 MMT}. {63593070 0 0 GMT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):235
                                                                                                                                                                                                                          Entropy (8bit):4.70181156382821
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52DkWJm2OHsvT5X26V/7VVpVCgekKB9TQ4U/w:MBp52DdJmdHsvVXHVVnmQ4U/w
                                                                                                                                                                                                                          MD5:B6562D5A53E05FAAD80671C88A9E01D3
                                                                                                                                                                                                                          SHA1:0014B14CFDDE47E603962935F8297C4C46533084
                                                                                                                                                                                                                          SHA-256:726980DCC13E0596094E01B8377E17029A2FCCE6FE93538C61E61BA620DD0971
                                                                                                                                                                                                                          SHA-512:D9C2838C89B0537C7F7A7319600D69D09AC004BD72358B452425A3B4861140246F71A94F004C2EF739620E81062F37ED9DA6D518F74956630006DD5674925A63
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Nairobi) {. {-9223372036854775808 8836 0 LMT}. {-1309746436 10800 0 EAT}. {-1262314800 9000 0 +0230}. {-946780200 9900 0 +0245}. {-315629100 10800 0 EAT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200
                                                                                                                                                                                                                          Entropy (8bit):4.8064239600480985
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52DjXm2OHNseVaxCXGFaS1HkFWTvLn:MBp52DjXmdHPVX8aS2yzn
                                                                                                                                                                                                                          MD5:459DA3ECBE5C32019D1130DDEAB10BAA
                                                                                                                                                                                                                          SHA1:DD1F6653A7B7B091A57EC59E271197CEC1892594
                                                                                                                                                                                                                          SHA-256:F36F8581755E1B40084442C43C60CC904C908285C4D719708F2CF1EADB778E2E
                                                                                                                                                                                                                          SHA-512:FF74D540157DE358E657E968C9C040B8FE5C806D22782D878575BFAC68779303E6071DC84D6773BC06D299AC971B0EB6B38CA50439161574B5A50FF6F1704046
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Ndjamena) {. {-9223372036854775808 3612 0 LMT}. {-1830387612 3600 0 WAT}. {308703600 7200 1 WAST}. {321314400 3600 0 WAT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.822255424633636
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcdhA9Ff2DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2Dsh2f2e
                                                                                                                                                                                                                          MD5:3142A6EAC3F36C872E7C32F8AF43A0F8
                                                                                                                                                                                                                          SHA1:0EACF849944A55D4AB8198DDD0D3C5494D1986DA
                                                                                                                                                                                                                          SHA-256:1704A1A82212E6DB71DA54E799D81EFA3279CD53A6BFA980625EE11126603B4C
                                                                                                                                                                                                                          SHA-512:BB3DADC393D0CF87934629BBFAFAD3AD9149B80843FC5447670812357CC4DFBCAF71F7104EBF743C06517BB42111B0DB9028B22F401A50E17085431C9200DAB2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Niamey) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.862257004762335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcboGb+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2Dqbb+V
                                                                                                                                                                                                                          MD5:6849FA8FFC1228286B08CE0950FEB4DD
                                                                                                                                                                                                                          SHA1:7F8E8069BA31E2E549566011053DA01DEC5444E9
                                                                                                                                                                                                                          SHA-256:2071F744BC880E61B653E2D84CED96D0AD2485691DDE9FFD38D3063B91E4F41F
                                                                                                                                                                                                                          SHA-512:30211297C2D8255D4B5195E9781931861A4DF55C431FFC6F83FE9C00A0089ED56179C07D33B1376C5DE8C0A9ABF2CFE473EF32AD14239DFD9599EA66BC286556
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Nouakchott) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.872638989714255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcXCZDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2D1DBP
                                                                                                                                                                                                                          MD5:7FF39BAAF47859EE3CD60F3E2C6DFC7D
                                                                                                                                                                                                                          SHA1:5CFC8B14222554156985031C7E9507CE3311F371
                                                                                                                                                                                                                          SHA-256:47E40BDBAC36CDB847C2E533B9D58D09FE1DBA2BED49C49BC75DD9086A63C6EB
                                                                                                                                                                                                                          SHA-512:DEEA0982593AE7757E70BD2E933B20B65CD9613891DC734AA4E6EC14D12AD119D2C69BA38E6FA4AE836C6CE14E57F35AE7F53345ACA4CF70AD67680E49BC6B7C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Ouagadougou) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.845403930433216
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsGe4FVAIgNGESIRL2DcyTKM0DcGev:SlSWB9IZaM3y7V4FVAIgNT9L2DQD4v
                                                                                                                                                                                                                          MD5:9A4C8187E8AC86B1CF4177702A2D933A
                                                                                                                                                                                                                          SHA1:6B54BBBE6D7ABC780EE11922F3AC50CDE3740A1F
                                                                                                                                                                                                                          SHA-256:6292CC41FE34D465E3F38552BDE22F456E16ABCBAC0E0B813AE7566DF3725E83
                                                                                                                                                                                                                          SHA-512:8008DB5E6F4F8144456021BB6B112B24ADB1194B1D544BBCB3E101E0684B63F4673F06A264C651A4BC0296CB81F7B4D73D47EAC7E1EC98468908E8B0086B2DDD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Lagos)]} {. LoadTimeZoneFile Africa/Lagos.}.set TZData(:Africa/Porto-Novo) $TZData(:Africa/Lagos).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):200
                                                                                                                                                                                                                          Entropy (8bit):4.8463501042309645
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52DcOFwFkXGm2OHzT5vXbeaFnvUdSa5FF1IEvWZvZYvCn:SlSWB9X52DIJm2OHH5PzdVacbLn
                                                                                                                                                                                                                          MD5:D28C0D0628DE3E5D9662A3376B20D5B4
                                                                                                                                                                                                                          SHA1:464351F257655F10732CA9A1E59CF6587B33F8A1
                                                                                                                                                                                                                          SHA-256:B9F317EAA504A195BD658BA7EE9EE22D816BF46A1FFDB8D8DA573D311A5FF78A
                                                                                                                                                                                                                          SHA-512:B056E7A16CE8E5CC420F88AF26E893348117306D66ED2DF4C6A6C2CA9F48783714E08AACF94BC646A1B4A2B3FB2080A4E53EDF4633C9AE259BBBA3F8ABE4DEE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Sao_Tome) {. {-9223372036854775808 1616 0 LMT}. {-2713912016 -2205 0 LMT}. {-1830384000 0 0 GMT}. {1514768400 3600 0 WAT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.85737401659099
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2DcHdDcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2DwdDBP
                                                                                                                                                                                                                          MD5:AF295B9595965712D77952D692F02C6B
                                                                                                                                                                                                                          SHA1:BC6737BD9BFD52FE538376A1441C59FB4FC1A038
                                                                                                                                                                                                                          SHA-256:13A06D69AEB38D7A2D35DF3802CEE1A6E15FA1F5A6648328A9584DD55D11E58C
                                                                                                                                                                                                                          SHA-512:E47C5EA2DFBC22CF9EAC865F67D01F5593D3CDDB51FDE24CDD13C8957B70F50111675D8E94CA859EC9B6FAA109B3EFA522C3985A69FE5334156FEE66B607006E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Africa/Timbuktu) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):920
                                                                                                                                                                                                                          Entropy (8bit):4.074538534246205
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52D0mdHrjWC+fGZni8hRSUNvoTC3yJ/Z9vPdq8UwLVFoBZdEthEK7st5kS1R:cQIevhR5FNgTbJ3b3D0WeXR
                                                                                                                                                                                                                          MD5:A53F5CD6FE7C2BDD8091E38F26EEA4D1
                                                                                                                                                                                                                          SHA1:90FB5EE343FCC78173F88CA59B35126CC8C07447
                                                                                                                                                                                                                          SHA-256:D2FCC1AD3BFE20954795F2CDFFFE96B483E1A82640B79ADAA6062B96D143E3C7
                                                                                                                                                                                                                          SHA-512:965E42972994AE79C9144323F87C904F393BA0CDF75186C346DA77CFAA1A2868C68AF8F2F1D63D5F06C5D1D4B96BA724DD4BC0DF7F5C4BD77E379AA674AE12DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tripoli) {. {-9223372036854775808 3164 0 LMT}. {-1577926364 3600 0 CET}. {-574902000 7200 1 CEST}. {-512175600 7200 1 CEST}. {-449888400 7200 1 CEST}. {-347158800 7200 0 EET}. {378684000 3600 0 CET}. {386463600 7200 1 CEST}. {402271200 3600 0 CET}. {417999600 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {465429600 3600 0 CET}. {481590000 7200 1 CEST}. {496965600 3600 0 CET}. {512953200 7200 1 CEST}. {528674400 3600 0 CET}. {544230000 7200 1 CEST}. {560037600 3600 0 CET}. {575852400 7200 1 CEST}. {591660000 3600 0 CET}. {607388400 7200 1 CEST}. {623196000 3600 0 CET}. {641775600 7200 0 EET}. {844034400 3600 0 CET}. {860108400 7200 1 CEST}. {875919600 7200 0 EET}. {1352505600 3600 0 CET}. {1364515200 7200 1 CEST}. {1382662800 7200 0 EET}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1072
                                                                                                                                                                                                                          Entropy (8bit):4.074604685883076
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52DgmdHjPbwSRjneMVyDKCNFWLFyBXS9/3S3K/CBmvyncSuZSqLS2C6oPwVFD:cQUejbwSRyS2Uyc+FcJLKgzmcx9b
                                                                                                                                                                                                                          MD5:1899EDCB30CDDE3A13FB87C026CD5D87
                                                                                                                                                                                                                          SHA1:4C7E25A36E0A62F3678BCD720FCB8911547BAC8D
                                                                                                                                                                                                                          SHA-256:F0E01AA40BB39FE64A2EB2372E0E053D59AA65D64496792147FEFBAB476C4EC3
                                                                                                                                                                                                                          SHA-512:FD22A2A7F9F8B66396152E27872CCBA6DA967F279BAF21BC91EF76E86B59505B3C21D198032B853427D9FFAB394FBB570F849B257D6F6821916C9AB29E7C37A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Tunis) {. {-9223372036854775808 2444 0 LMT}. {-2797202444 561 0 PMT}. {-1855958961 3600 0 CET}. {-969242400 7200 1 CEST}. {-950493600 3600 0 CET}. {-941940000 7200 1 CEST}. {-891136800 3600 0 CET}. {-877827600 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-842918400 3600 0 CET}. {-842223600 7200 1 CEST}. {-828230400 3600 0 CET}. {-812502000 7200 1 CEST}. {-796269600 3600 0 CET}. {-781052400 7200 1 CEST}. {-766634400 3600 0 CET}. {231202800 7200 1 CEST}. {243903600 3600 0 CET}. {262825200 7200 1 CEST}. {276044400 3600 0 CET}. {581122800 7200 1 CEST}. {591145200 3600 0 CET}. {606870000 7200 1 CEST}. {622594800 3600 0 CET}. {641516400 7200 1 CEST}. {654649200 3600 0 CET}. {1114902000 7200 1 CEST}. {1128038400 3600 0 CET}. {1143334800 7200 1 CEST}. {1162083600 3600 0 CET}. {1174784400 7200 1 CEST}. {1193533200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1591
                                                                                                                                                                                                                          Entropy (8bit):3.915421470240155
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5qtCmcMxTFD9nJivm/8ySy/tnwfn8OIxJJSV1AnNlKQmX0UTjJx2MgXgprKfks1/:QCj6tXww023zn/
                                                                                                                                                                                                                          MD5:18BD78EB14E153DAAAAE70B0A6A2510C
                                                                                                                                                                                                                          SHA1:A91BA216A2AB62B138B1F0247D75FBA14A5F05C0
                                                                                                                                                                                                                          SHA-256:639A57650A4EA5B866EAAA2EEC0562233DC92CF9D6955AC387AD954391B850B1
                                                                                                                                                                                                                          SHA-512:88F34732F843E95F2A2AD4FAA0B5F945DD69B65FDDB4BB7DD957B95283B7AE995F52050B45A6332864C1C5CC4611390F6827D82569D343B5E1B9DDFE0AE5A633
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Africa/Windhoek) {. {-9223372036854775808 4104 0 LMT}. {-2458170504 5400 0 +0130}. {-2109288600 7200 0 SAST}. {-860976000 10800 1 SAST}. {-845254800 7200 0 SAST}. {637970400 7200 0 CAT}. {764200800 3600 1 WAT}. {778640400 7200 0 CAT}. {796780800 3600 1 WAT}. {810090000 7200 0 CAT}. {828835200 3600 1 WAT}. {841539600 7200 0 CAT}. {860284800 3600 1 WAT}. {873594000 7200 0 CAT}. {891734400 3600 1 WAT}. {905043600 7200 0 CAT}. {923184000 3600 1 WAT}. {936493200 7200 0 CAT}. {954633600 3600 1 WAT}. {967942800 7200 0 CAT}. {986083200 3600 1 WAT}. {999392400 7200 0 CAT}. {1018137600 3600 1 WAT}. {1030842000 7200 0 CAT}. {1049587200 3600 1 WAT}. {1062896400 7200 0 CAT}. {1081036800 3600 1 WAT}. {1094346000 7200 0 CAT}. {1112486400 3600 1 WAT}. {1125795600 7200 0 CAT}. {1143936000 3600 1 WAT}. {1157245200 7200 0 CAT}. {1175385600 3600 1 WAT}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8171
                                                                                                                                                                                                                          Entropy (8bit):3.783938143940452
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:DGWQm82ctfc/TVu7pAmKABmAlJD1NPaTsrEe50IC:DGWQm67pAmKABmiD1R2sG
                                                                                                                                                                                                                          MD5:DD838D2C8CF84B775BBCBA7868E7FFB5
                                                                                                                                                                                                                          SHA1:509CFC15E2CBFC2F183B4A3CDEC42C8427EBA825
                                                                                                                                                                                                                          SHA-256:01A88ADE038DDD264B74ED921441642CAA93830CEF9594F70188CCF6D19C4664
                                                                                                                                                                                                                          SHA-512:9D520CADC0134E7812B5643311246CED011A22D50240A03260478C90B69EC325AE5BD7548BA266E00253AC3288605A912C5DBB026EA1516CB2030F302BFCDF0E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Adak) {. {-9223372036854775808 44002 0 LMT}. {-3225223727 -42398 0 LMT}. {-2188944802 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8410
                                                                                                                                                                                                                          Entropy (8bit):3.882284820226162
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:RWFxXw34N+YXSUKC8aaIqDPRs/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:Rsd6M/4h5sBPy+CMt/ElALLVuAH
                                                                                                                                                                                                                          MD5:30468928CFDD0B6AAC8EA5BF84956E21
                                                                                                                                                                                                                          SHA1:0B146D4D789CD49F0A7FEDFFE85FFD31C0926D9C
                                                                                                                                                                                                                          SHA-256:202A45DEBFD6E92EF21E2FFF37281C1DE5B4AF4C79DC59A642013EBB37FE5AF0
                                                                                                                                                                                                                          SHA-512:721049A2C751BC3F90B0D757C85F59971B46C70942B2F8A20B0E0E0834B89BBE9A5F16D20AEB5F58C1B6268D71DD5F39F9135C60FDE692E3E472598E054C1D96
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Anchorage) {. {-9223372036854775808 50424 0 LMT}. {-3225223727 -35976 0 LMT}. {-2188951224 -36000 0 AST}. {-883576800 -36000 0 AST}. {-880200000 -32400 1 AWT}. {-769395600 -32400 1 APT}. {-765378000 -36000 0 AST}. {-86882400 -36000 0 AHST}. {-31500000 -36000 0 AHST}. {-21470400 -32400 1 AHDT}. {-5749200 -36000 0 AHST}. {9979200 -32400 1 AHDT}. {25700400 -36000 0 AHST}. {41428800 -32400 1 AHDT}. {57754800 -36000 0 AHST}. {73483200 -32400 1 AHDT}. {89204400 -36000 0 AHST}. {104932800 -32400 1 AHDT}. {120654000 -36000 0 AHST}. {126705600 -32400 1 AHDT}. {152103600 -36000 0 AHST}. {162388800 -32400 1 AHDT}. {183553200 -36000 0 AHST}. {199281600 -32400 1 AHDT}. {215607600 -36000 0 AHST}. {230731200 -32400 1 AHDT}. {247057200 -36000 0 AHST}. {262785600 -32400 1 AHDT}. {278506800 -36000 0 AHST}. {294235200 -32400 1 AHDT}. {309956400 -360
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):203
                                                                                                                                                                                                                          Entropy (8bit):4.9101657646476164
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290/8J5290e/:MBaIMY9QpI290/8m90O
                                                                                                                                                                                                                          MD5:F7D915076ABE4FF032E13F8769D38433
                                                                                                                                                                                                                          SHA1:F930A8943E87105EE8523F640EA6F65BD4C9CE78
                                                                                                                                                                                                                          SHA-256:9D368458140F29D95CAB9B5D0259DE27B52B1F2E987B4FA1C12F287082F4FE56
                                                                                                                                                                                                                          SHA-512:63C99FFA65F749B7637D0DF5A73A21AC34DFEAD364479DE992E215258A82B9C15AB0D45AAF29BD2F259766346FDB901412413DD44C5D45BB8DF6B582C34F48B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Anguilla) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):202
                                                                                                                                                                                                                          Entropy (8bit):4.90033942341457
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290//MFe90e/:MBaIMY9QpI290//V90O
                                                                                                                                                                                                                          MD5:25CA3996DDB8F1964D3008660338BA72
                                                                                                                                                                                                                          SHA1:B66D73B5B38C2CCCA78232ADC3572BBBEB79365D
                                                                                                                                                                                                                          SHA-256:A2ABBD9BCFCE1DB1D78C99F4993AC0D414A08DB4AC5CE915B81119E17C4DA76F
                                                                                                                                                                                                                          SHA-512:A25AFE4FD981F458FE194A5D87C35BE5FC7D4426C1EEE8311AE655BB53364CD4AAC0710C0D7E6A91C0F248E2A6916902F4FD43A220CFF7A6474B77D93CF35C81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Antigua) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1722
                                                                                                                                                                                                                          Entropy (8bit):3.6435096006301833
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5s4h19U2dBUGrmO7XGtN3kh0VKnNIVkHZU7WWhKRWRN:Cm19U2zUGrpzGtVE0VKnyVkHZWWWhKRG
                                                                                                                                                                                                                          MD5:6349567E3ED0FD11DD97056D2CFF11EE
                                                                                                                                                                                                                          SHA1:404F1B311D7072A6372351366BA15BB94F3AC7D2
                                                                                                                                                                                                                          SHA-256:41C816E9C0217A01D9288014013CD1D315B2CEB719F8BB310670D02B664A4462
                                                                                                                                                                                                                          SHA-512:782910DFA0FF8FEDB94D622271FA0FF983BC50A4FEE95FFC8EC3E89FB123B82C26701D81A994A8248F1C1CA0B1EF49C2752C4D7B498A0A623D79E2B6753DA432
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Araguaina) {. {-9223372036854775808 -11568 0 LMT}. {-1767214032 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1981
                                                                                                                                                                                                                          Entropy (8bit):3.6790048972731686
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5Wcap0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWvXydhSTP:vC0ZB9yRwhS+/po/lKENURMo8XvCWvX1
                                                                                                                                                                                                                          MD5:93B8CF61EDC7378C39BE33A77A4222FC
                                                                                                                                                                                                                          SHA1:8A01D2B22F8FC163B0FDCED4305C3FA08336AF7D
                                                                                                                                                                                                                          SHA-256:35E05545A12E213DCBC0C2F7FDCA5C79CD522E7D2684EDF959E8A0A991BEF3C8
                                                                                                                                                                                                                          SHA-512:68333AB0C9348AF0994DB26FB6D34FF67ABF56AF1FBABB77F2C9EFF20E9A2DB2B59C5B81DF0C42299DE459B03DF13E07071B84576E62597920D1848F1E1FC9E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Buenos_Aires) {. {-9223372036854775808 -14028 0 LMT}. {-2372097972 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-73378
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2009
                                                                                                                                                                                                                          Entropy (8bit):3.6543367491742913
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5f4p0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSTK+:No0ZB9yRwhS+/po/lKENURMo8XvCWg7r
                                                                                                                                                                                                                          MD5:7FCA355F863158D180B3179782A6E8C8
                                                                                                                                                                                                                          SHA1:CDFBC98923F7315388009F22F9C37626B677321F
                                                                                                                                                                                                                          SHA-256:C3FE34E5BE68503D78D63A2AFB5C970584D0854C63648D7FE6E2412A4E5B008F
                                                                                                                                                                                                                          SHA-512:6C2F9598C714BEBA7A538AAB7FA68C1962001C426C80B21F2A9560C72BCEA87B956821E68AF30B4576C1ECDB07E33D616934BD49943DA2E45841B10D483833C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Catamarca) {. {-9223372036854775808 -15788 0 LMT}. {-2372096212 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-73378080
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):237
                                                                                                                                                                                                                          Entropy (8bit):4.672788403288451
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs290/MquQ90/MMXAv:MBaIMY/Mhp/MP290/MquQ90/MH
                                                                                                                                                                                                                          MD5:42D568B6100D68F9E5698F301F4EC136
                                                                                                                                                                                                                          SHA1:E0A5F43A80EB0FAAFBD45127DCAF793406A4CF3A
                                                                                                                                                                                                                          SHA-256:D442E5BBB801C004A7903F6C217149FCDA521088705AC9FECB0BC3B3058981BF
                                                                                                                                                                                                                          SHA-512:99580239B40247AF75FFAA44E930CDECB71F6769E3597AC85F19A8816F7D0859F6A0D5499AFAC2FA35C32BA05B75B27C77F36DE290DD0D442C0769D6F41E96DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Argentina/ComodRivadavia) $TZData(:America/Argentina/Catamarca).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1976
                                                                                                                                                                                                                          Entropy (8bit):3.659938468164974
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5zxpp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSTP:1xT0ZB9yRwhS+/po/lKENURMo8XvCWgJ
                                                                                                                                                                                                                          MD5:C6A4EED52A2829671089F9E84D986BFB
                                                                                                                                                                                                                          SHA1:F5BBDD0C3347C7519282249AA48543C01DA95B7A
                                                                                                                                                                                                                          SHA-256:50541A1FBACAD2C93F08CD402A609C4984AF66E27DB9FAA7F64FDA93DDC57939
                                                                                                                                                                                                                          SHA-512:52EA5BB27C91C753275EAC90E082EEBE98B5997B830D8DD579174558355E3FED0AAF4AA02679B0866591951F04F358AFB113423872D57820143E75FEB4415B60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Cordoba) {. {-9223372036854775808 -15408 0 LMT}. {-2372096592 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1974
                                                                                                                                                                                                                          Entropy (8bit):3.659895575974408
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5rCp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCfSWnzydhSR:FK0ZB9yRwhS+/po/lKENURMo8XvCfbzD
                                                                                                                                                                                                                          MD5:A7F2318729F0B4B04C9176CB5257691E
                                                                                                                                                                                                                          SHA1:0EAD91CBDC640DB67F64A34209359674AC47062A
                                                                                                                                                                                                                          SHA-256:E33962F99E6022ED1825898990B38C10F505DE6EC44DAFB00C75E3A7C1A61C8A
                                                                                                                                                                                                                          SHA-512:CB80580383309CCA4837556ED0444F2B931E1B3B13582023BFB715393C94C4F1279D8EC18CACB06BB13E3D32A535495DF2D093E225DF7B6DFFD3571A3B3573B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Jujuy) {. {-9223372036854775808 -15672 0 LMT}. {-2372096328 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800 -1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2037
                                                                                                                                                                                                                          Entropy (8bit):3.655968476161033
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5J6p0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWXXydhSTK+:Hi0ZB9yRwhS+/po/lKENURMo8XvCWXXr
                                                                                                                                                                                                                          MD5:49BB6DAD5560E7C6EAEA6F3CF9EB1F67
                                                                                                                                                                                                                          SHA1:56E0D9DD4E6B12522A75F0ABFEBB6AE019614CB5
                                                                                                                                                                                                                          SHA-256:13CBECD826DD5DE4D8576285FC6C4DE39F2E9CF03F4A61F75316776CAED9F878
                                                                                                                                                                                                                          SHA-512:CA7EF1A94A6635EAB644C5EAAC2B890E7401745CFA97609BDA410D031B990C87EB2F97160731A45B5A8ADE48D883EAB529AE2379406852129102F0FDF92247D8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/La_Rioja) {. {-9223372036854775808 -16044 0 LMT}. {-2372095956 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2009
                                                                                                                                                                                                                          Entropy (8bit):3.649537276151328
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5Yep0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCpSGSldhSTS:C+0ZB9yRwhS+/po/lKENURMo8XvCpVap
                                                                                                                                                                                                                          MD5:69F8A1AC33BE03C008EC5FEBD1CE4CAA
                                                                                                                                                                                                                          SHA1:858362EFEA0C68C1EC9295A9FCE647B41DBF429D
                                                                                                                                                                                                                          SHA-256:B02DDE8DCF8E68B2B1DBF66ADF5B247E9833FEC347DFBC487C391FADA5706AD3
                                                                                                                                                                                                                          SHA-512:8373EAEEBF5EA028CC0673B10E9DFE84F4DFC2F9E9E8320D59E6CE6125643B31F5E61FC894E420A8D7E9C2FF242617DF911ABF0884AF5B32316A098C8524772D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Mendoza) {. {-9223372036854775808 -16516 0 LMT}. {-2372095484 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2012
                                                                                                                                                                                                                          Entropy (8bit):3.6703415662732746
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5mpp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWvXydhSTK+:oT0ZB9yRwhS+/po/lKENURMo8XvCWvXr
                                                                                                                                                                                                                          MD5:AC8E561F7573280594BDD898324E9442
                                                                                                                                                                                                                          SHA1:7DC6248ED29719700189FF3A69D06AAC7B54EB6B
                                                                                                                                                                                                                          SHA-256:0833962C0DE220BC601D764EE14442E98F83CB581816B74E5867540348227250
                                                                                                                                                                                                                          SHA-512:2FDD23ABA891EBEF01944F3C8F1A9E6844C182B0EB2CBEC0F942F268BAE51F0D7775370E262B500FE7151210F8849DD54BA5CEB2160AE03A5747A48A10933F05
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Rio_Gallegos) {. {-9223372036854775808 -16612 0 LMT}. {-2372095388 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-73378
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1945
                                                                                                                                                                                                                          Entropy (8bit):3.653135248071002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5Vgp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSTQO:7w0ZB9yRwhS+/po/lKENURMo8XvCWg7D
                                                                                                                                                                                                                          MD5:70FB90E24FEEF5211C9488C938295F02
                                                                                                                                                                                                                          SHA1:5C903A669B51A1635284AD80877E0C6789D8EB26
                                                                                                                                                                                                                          SHA-256:FBDACFA5D82DC23ECDD9D9F8A4EF71F7DBB579BF4A621C545062A7AE0296141D
                                                                                                                                                                                                                          SHA-512:4C36B34B2203F6D4C78CC6F0E061BF35C4B98121D50096C8015EBA6DBEFA989DD2F2E32436EEE3055F1CF466BC3D4FD787A89873EEE4914CB51B273E335C90C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Salta) {. {-9223372036854775808 -15700 0 LMT}. {-2372096300 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800 -1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2037
                                                                                                                                                                                                                          Entropy (8bit):3.6597750686514887
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5jXup0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWXXydhSTH:1+0ZB9yRwhS+/po/lKENURMo8XvCWXXh
                                                                                                                                                                                                                          MD5:BBB4D4B341E7FEC2E5A937267AADCD0F
                                                                                                                                                                                                                          SHA1:9AB509F97DCBAAE5ACA7F67853E86429438ED8DC
                                                                                                                                                                                                                          SHA-256:BAC6CC41865DD3D4F042FE6106176279F3DEB9127BE0146AF75AE1E47098AF43
                                                                                                                                                                                                                          SHA-512:49E32BD5BDBA773D99C883080660B431E8D4C806164C0354C848CF3AB0042797DBE7F6226BA234634A1DF254B0464ED5F714B054454520263536B0A77D7053D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Juan) {. {-9223372036854775808 -16444 0 LMT}. {-2372095556 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2013
                                                                                                                                                                                                                          Entropy (8bit):3.6516068215670687
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:58kp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCp1ESWn0SK4:K80ZB9yRwhS+/po/lKENURMo8XvCpmTr
                                                                                                                                                                                                                          MD5:767F99822C382327A318EAC0779321F3
                                                                                                                                                                                                                          SHA1:1352B21F20C7F742D57CB734013143C9B58DA221
                                                                                                                                                                                                                          SHA-256:B4590DF5AC1993E10F508CC5183809775F5248B565400BA05AE5F87B69D4E26B
                                                                                                                                                                                                                          SHA-512:C8FF21DC573DE5CB327DDA536391071012A038B8266C4E39922EC0F0EC975000E5D7AFBBE81D1C28DB8733E8B01E1E4D6BE0968D9EFCFC50DB102CC09BDABEA6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/San_Luis) {. {-9223372036854775808 -15924 0 LMT}. {-2372096076 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2036
                                                                                                                                                                                                                          Entropy (8bit):3.653313944168433
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5yM9Ep0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWg7ydhSU:b9c0ZB9yRwhS+/po/lKENURMo8XvCWgi
                                                                                                                                                                                                                          MD5:892E23EEB82C4EF52CB830C607E3DD6D
                                                                                                                                                                                                                          SHA1:9A9334DC1F9FBA0152C1B5CAA954F2FF1775B78C
                                                                                                                                                                                                                          SHA-256:F3D19E51463B4D04BE1CD4F36CD9DD5E3954B6186ADD6A176B78C3C4F399CCA1
                                                                                                                                                                                                                          SHA-512:4FCC3F61E261D57788756921AE21E54D387AB533ACF56182579B9082EC0791CD655D50BEDDAF996233CDBDE549F743855C191BCB581EF3D7877C4CE26B14EEC2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Tucuman) {. {-9223372036854775808 -15652 0 LMT}. {-2372096348 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2007
                                                                                                                                                                                                                          Entropy (8bit):3.6562927023582197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:56Yp0SaS2SeSNS2S/SwS8gSvJ1/SKSHSRCSiS9SDS+SGwRShoSdXvCWvXydhSTHd:QI0ZB9yRwhS+/po/lKENURMo8XvCWvXz
                                                                                                                                                                                                                          MD5:EA31C60D08FFE56504DEC62A539F51D9
                                                                                                                                                                                                                          SHA1:79F31368AC9C141B5F0F5804A0D903C12B75A386
                                                                                                                                                                                                                          SHA-256:4E3A4539FE0D8E0401C8304E5A79F40C420333C92BF1227BCBB5DB242444ECD6
                                                                                                                                                                                                                          SHA-512:EB58A3122DE8FC7887622D3716E1D9D615625FC47C30BA0BD8112894B595263F04B37D43E142C43251C48D2CD703BB6F56966B965C5475DA83F2C290B6F564E8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Argentina/Ushuaia) {. {-9223372036854775808 -16392 0 LMT}. {-2372095608 -15408 0 CMT}. {-1567453392 -14400 0 -04}. {-1233432000 -10800 0 -04}. {-1222981200 -14400 0 -04}. {-1205956800 -10800 1 -04}. {-1194037200 -14400 0 -04}. {-1172865600 -10800 1 -04}. {-1162501200 -14400 0 -04}. {-1141329600 -10800 1 -04}. {-1130965200 -14400 0 -04}. {-1109793600 -10800 1 -04}. {-1099429200 -14400 0 -04}. {-1078257600 -10800 1 -04}. {-1067806800 -14400 0 -04}. {-1046635200 -10800 1 -04}. {-1036270800 -14400 0 -04}. {-1015099200 -10800 1 -04}. {-1004734800 -14400 0 -04}. {-983563200 -10800 1 -04}. {-973198800 -14400 0 -04}. {-952027200 -10800 1 -04}. {-941576400 -14400 0 -04}. {-931032000 -10800 1 -04}. {-900882000 -14400 0 -04}. {-890337600 -10800 1 -04}. {-833749200 -14400 0 -04}. {-827265600 -10800 1 -04}. {-752274000 -14400 0 -04}. {-733780800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.760006229014668
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE/nVIAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE290/V90J
                                                                                                                                                                                                                          MD5:84605CB5AC93D51FF8C0C3D46B6A566F
                                                                                                                                                                                                                          SHA1:8B56DBDAD33684743E5828EFBD638F082E9AA20D
                                                                                                                                                                                                                          SHA-256:680651D932753C9F9E856018B7C1B6D944536111900CB56685ABA958DE9EC9C1
                                                                                                                                                                                                                          SHA-512:A5FA747C4743130308A8D8832AD33CF10B2DA2F214DEE129CAC9543D6F88FF232B4387026976578D037DF7816D0F4177835866A35F497438DD2526FEBACA2AF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Aruba) $TZData(:America/Curacao).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7685
                                                                                                                                                                                                                          Entropy (8bit):3.4198614734785875
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:57TOr5dwtvNJZWDQ2eBTVSZKnb0Yg6f5xgTK5IQPyP8D3rVPe9DptTkhXXkbCkCg:5P7J1A
                                                                                                                                                                                                                          MD5:625A707182C6E0027D49F0FFD775AC51
                                                                                                                                                                                                                          SHA1:6423A50DB875051656A1C3C5B6C6AF556F8FBE0A
                                                                                                                                                                                                                          SHA-256:CD884C5C99949F5723DC94FBFF011B97AE0989EF2EDE089B30C2CD4893AFCE08
                                                                                                                                                                                                                          SHA-512:C5787953997D7D1B583AEE7F68FCC255AC1FAC5C9A7025C8093F274206A0C8163DE221B4823F7750B5B30AF32D673F88D5956C0E510851EBA72CC2360AC35D18
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Asuncion) {. {-9223372036854775808 -13840 0 LMT}. {-2524507760 -13840 0 AMT}. {-1206389360 -14400 0 -04}. {86760000 -10800 0 -03}. {134017200 -14400 0 -04}. {162878400 -14400 0 -04}. {181368000 -10800 1 -04}. {194497200 -14400 0 -04}. {212990400 -10800 1 -04}. {226033200 -14400 0 -04}. {244526400 -10800 1 -04}. {257569200 -14400 0 -04}. {276062400 -10800 1 -04}. {291783600 -14400 0 -04}. {307598400 -10800 1 -04}. {323406000 -14400 0 -04}. {339220800 -10800 1 -04}. {354942000 -14400 0 -04}. {370756800 -10800 1 -04}. {386478000 -14400 0 -04}. {402292800 -10800 1 -04}. {418014000 -14400 0 -04}. {433828800 -10800 1 -04}. {449636400 -14400 0 -04}. {465451200 -10800 1 -04}. {481172400 -14400 0 -04}. {496987200 -10800 1 -04}. {512708400 -14400 0 -04}. {528523200 -10800 1 -04}. {544244400 -14400 0 -04}. {560059200 -10800 1 -04}. {57586
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):332
                                                                                                                                                                                                                          Entropy (8bit):4.582750266902939
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290/qlfbm2OHvcFGxYP329V/uFn/TUs/uFn/lHIs8/kRm5/uFb/C/iin:MBp5290/emdHLYP323/uFn/9/uFn/dBs
                                                                                                                                                                                                                          MD5:66777BB05E04E030FABBC70649290851
                                                                                                                                                                                                                          SHA1:97118A1C4561FC1CC9B7D18EE2C7D805778970B8
                                                                                                                                                                                                                          SHA-256:2C6BBDE21C77163CD32465D773F6EBBA3332CA1EAEEF88BB95F1C98CBCA1562D
                                                                                                                                                                                                                          SHA-512:B00F01A72A5306C71C30B1F0742E14E23202E03924887B2418CA6F5513AE59E12BC45F62B614716BBE50A7BEA8D62310E1B67BB39B84F7B1B40C5D2D19086B7C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Atikokan) {. {-9223372036854775808 -21988 0 LMT}. {-2366733212 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765388800 -18000 0 EST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):172
                                                                                                                                                                                                                          Entropy (8bit):4.761501750421919
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvt2IAcGE/ol7x+IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9F290/ola
                                                                                                                                                                                                                          MD5:E641C6615E1EF015427202803761AADD
                                                                                                                                                                                                                          SHA1:E254129517335E60D82DFE00C6D5AF722D36565A
                                                                                                                                                                                                                          SHA-256:9C546927B107BB4AB345F618A91C0F8C03D8A366028B2F0FCBF0A3CE29E6588E
                                                                                                                                                                                                                          SHA-512:B7D34B1EA0D6722D7BFCD91F082D79EE009B97A2B5684D76A3F04CB59079637134275CF9A0306B9F4423A03CC0C2AB43994207D1B209161C893C2C6F3F3B6311
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:America/Atka) $TZData(:America/Adak).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1944
                                                                                                                                                                                                                          Entropy (8bit):3.6123892296166242
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:534h19U2dBUGrmO7XGtN3kh0OjmimtnNIVkHZU7WWhw5N:Nm19U2zUGrpzGtVE0OjmicnyVkHZWWWK
                                                                                                                                                                                                                          MD5:E52095DB1E77EC4553A0AF56665CDE51
                                                                                                                                                                                                                          SHA1:CED0966E8D89443F2CCBBE9F44DA683F7D2D688B
                                                                                                                                                                                                                          SHA-256:30A4658BD46F88A1585ACABB9EB6BA03DB929EAF7D2F430BC4864D194A6CC0DD
                                                                                                                                                                                                                          SHA-512:D6F3D51393F9D8F6414023A8435213EC6BD4FCAA5084B664B828CCDE8D57821E3E284B3D5A27414B4C2AB0B71E31D775D1F924C926C849F591D361DAA8681D8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia) {. {-9223372036854775808 -9244 0 LMT}. {-1767216356 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}. {602
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6625
                                                                                                                                                                                                                          Entropy (8bit):3.791871111929614
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:NqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmbwBlhcCLfYkNRfsNz:NqZL/1dCYDDCxyH4RxGIJkYWXsWwav7S
                                                                                                                                                                                                                          MD5:6A18936EC3AA0FCEC8A230ADAF90FF1E
                                                                                                                                                                                                                          SHA1:B13B8BF1FD2EEED44F63A0DC71F0BCE8AC15C783
                                                                                                                                                                                                                          SHA-256:974481F867DEA51B6D8C6C21432F9F6F7D6A951EC1C34B49D5445305A6FB29B7
                                                                                                                                                                                                                          SHA-512:75AA7A3AE63ED41AFF6CF0F6DC3CA649786A86A64293E715962B003383D31A8AD2B99C72CE6B788EC4DFF1AF7820F011B3F1FD353B37C326EF02289CE4A061BF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bahia_Banderas) {. {-9223372036854775808 -25260 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):413
                                                                                                                                                                                                                          Entropy (8bit):4.429320498710922
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290eNJmdH9Gcvm/uFkCFP/K/uFkCFks/v/h/uFkCFFoI/qZ/uFkCF3dX/r:cQT7enmSkC9/KSkCT/BSkCLl/wSkCj/r
                                                                                                                                                                                                                          MD5:49EED111AB16F289E7D2D145A2641720
                                                                                                                                                                                                                          SHA1:2F0A37524209FC26421C2951F169B4352250ED9E
                                                                                                                                                                                                                          SHA-256:E7415944397EF395DDBD8EACB6D68662908A25E2DB18E4A3411016CBB6B8AFC6
                                                                                                                                                                                                                          SHA-512:3AD4511798BA763C4E4A549340C807FE2FDF6B107C74A977E425734BBADDFF44ADAA68B5AE1F96170902A10208BC4BBF551C596EB1A3E292071549B8F3012A35
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Barbados) {. {-9223372036854775808 -14309 0 LMT}. {-1451678491 -14309 0 BMT}. {-1199217691 -14400 0 AST}. {234943200 -10800 1 ADT}. {244616400 -14400 0 AST}. {261554400 -10800 1 ADT}. {276066000 -14400 0 AST}. {293004000 -10800 1 ADT}. {307515600 -14400 0 AST}. {325058400 -10800 1 ADT}. {338706000 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):996
                                                                                                                                                                                                                          Entropy (8bit):3.799419505060255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQYe3wc4h1u80V2dBUGphmC17ewGtN3kN:5VB4h19U2dBUGrmO7XGtN3kN
                                                                                                                                                                                                                          MD5:2F3314B71810C1AC0280F292F09F37BE
                                                                                                                                                                                                                          SHA1:B8702125A9768AE530354CE2A765BC07BABAEF34
                                                                                                                                                                                                                          SHA-256:9ECA949D328915C6CB02A2E6084F3E0730D49F1C53C6D6AA12751F852C51BF02
                                                                                                                                                                                                                          SHA-512:C4E1ADD2E580BFD4100EE776305530BCEA017D57A65205881536A1CDDA3A299816C133B5B1F4B40A99E47BB94AE2A7E727F3D24D06131705818CC0C1AA12E5BD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belem) {. {-9223372036854775808 -11636 0 LMT}. {-1767213964 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {590032800 -10800 0 -03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1854
                                                                                                                                                                                                                          Entropy (8bit):3.8463726575443573
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQMeVyJOCSSVTSuWcLwX1QIXVlXco0bKdTu/pUHQGyUrROSTgltVJyODrUSn/mJO:5hxKj4jDMtVpIM/mjM/sQ
                                                                                                                                                                                                                          MD5:1BFD01ECF77E031C23BDA5ED371E061F
                                                                                                                                                                                                                          SHA1:7A38C5665A834B812613E4D10FE4D1E45F606407
                                                                                                                                                                                                                          SHA-256:BDF09D97876E3A3C0422C655562252806B4EF914679FDCAB6DD78BD2B84DD932
                                                                                                                                                                                                                          SHA-512:D7A2C2645129C4BAB1F0170A29A084396AD8CF07237DE339512C3A5C7227B017BF1D4B78EBD5A7274CAF1D172ECB2DB6F912887BFF1C6AC73E9D645E333A75A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Belize) {. {-9223372036854775808 -21168 0 LMT}. {-1822500432 -21600 0 CST}. {-1616954400 -19800 1 -0530}. {-1606069800 -21600 0 CST}. {-1585504800 -19800 1 -0530}. {-1574015400 -21600 0 CST}. {-1554055200 -19800 1 -0530}. {-1542565800 -21600 0 CST}. {-1522605600 -19800 1 -0530}. {-1511116200 -21600 0 CST}. {-1490551200 -19800 1 -0530}. {-1479666600 -21600 0 CST}. {-1459101600 -19800 1 -0530}. {-1448217000 -21600 0 CST}. {-1427652000 -19800 1 -0530}. {-1416162600 -21600 0 CST}. {-1396202400 -19800 1 -0530}. {-1384713000 -21600 0 CST}. {-1364752800 -19800 1 -0530}. {-1353263400 -21600 0 CST}. {-1333303200 -19800 1 -0530}. {-1321813800 -21600 0 CST}. {-1301248800 -19800 1 -0530}. {-1290364200 -21600 0 CST}. {-1269799200 -19800 1 -0530}. {-1258914600 -21600 0 CST}. {-1238349600 -19800 1 -0530}. {-1226860200 -21600 0 CST}. {-1206900000 -1980
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):331
                                                                                                                                                                                                                          Entropy (8bit):4.599775510303771
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290Am2OHff4YPawmX/bVVFUFkCFVUP/GH6/XVVFUFkIZVVFUFkeF3k/g:MBp5290AmdHff4YPawY/b/uFkCFVUP/L
                                                                                                                                                                                                                          MD5:5ACBD50E1CB87B4E7B735A8B5281917B
                                                                                                                                                                                                                          SHA1:3E92C60B365C7E1F9BF5F312B007CBFD4175DB8F
                                                                                                                                                                                                                          SHA-256:E61F3762B827971147772A01D51763A18CC5BED8F736000C64B4BDFF32973803
                                                                                                                                                                                                                          SHA-512:9284FFDF115C7D7E548A06A6513E3591F88EE3E5197106B71B54CD82F27890D12773381218BCA69720F074A6762282F25830422DFA402FF19301D6834FD9FF7D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Blanc-Sablon) {. {-9223372036854775808 -13708 0 LMT}. {-2713896692 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {14400 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1159
                                                                                                                                                                                                                          Entropy (8bit):3.7116873200926586
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQETmex8Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSjx:5EqSaSwXS4SqSbS3JSySxSxcSESAlSQE
                                                                                                                                                                                                                          MD5:0858FCA5A59C9C6EE38B7E8A61307412
                                                                                                                                                                                                                          SHA1:685597A5FD8BFEBF3EC558DB8ABF11903F63E05E
                                                                                                                                                                                                                          SHA-256:825E89E4B35C9BA92CF53380475960C36307BF11FD87057891DF6EEBA984A88D
                                                                                                                                                                                                                          SHA-512:7369EE42CD73CFD635505BF784E16A36C9BBDE0BDAAAB405CB8401EBC508F4CE0B0155206756C1905E915756F1D3CDC381C6B9C357A01EAE0ECC4C448978844A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boa_Vista) {. {-9223372036854775808 -14560 0 LMT}. {-1767211040 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400 -1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):237
                                                                                                                                                                                                                          Entropy (8bit):4.649012348678967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290bJqm2OHDgPcuknTEXPKV93kR/uFeEV/KV9C:MBp5290bUmdHDgPcukT8O93Y/uF7/O9C
                                                                                                                                                                                                                          MD5:4B3B0F66FB3BC69A5AB5DA79D02F7E34
                                                                                                                                                                                                                          SHA1:79B84C0578BBB0E4C07E99977D02EDE45F11CC8A
                                                                                                                                                                                                                          SHA-256:E7C45CA67F1BA913E7DC1632C166973FDA8DA4734F8BCF3AB1157A45454C8D7B
                                                                                                                                                                                                                          SHA-512:96289B4D179F146D6C5FB5DDAA4336CBCB60CF27BABCC20B9691387920897B293903DF41F5D9DE7237A689013A9266134B32AB4B4656796419B46E8378D84358
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Bogota) {. {-9223372036854775808 -17776 0 LMT}. {-2707671824 -17776 0 BMT}. {-1739041424 -18000 0 -05}. {704869200 -14400 1 -05}. {733896000 -18000 0 -05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8324
                                                                                                                                                                                                                          Entropy (8bit):3.772029913040983
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:e45eG5cnWsGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:xGnWdVUC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:239425659E7345C757E6A44ABF258A22
                                                                                                                                                                                                                          SHA1:9659217B4D55795333DFA5E08451B69D17F514AD
                                                                                                                                                                                                                          SHA-256:6D6D377DDF237B1C5AB012DDDEB5F4FAA39D1D51240AA5C4C34EE96556D2D2F4
                                                                                                                                                                                                                          SHA-512:3891D7BC1F84FF6B01B6C2DF6F0413C9E168E5B84CE445030F1B871766DD38B2FF7418501AB7C0DCEAB8381E538D65DF4E7708502EE924546A28DF1AC9BB7129
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Boise) {. {-9223372036854775808 -27889 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-1471788000 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126255600 -25200 0 MST}. {129114000 -21600 0 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {2307
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):234
                                                                                                                                                                                                                          Entropy (8bit):4.775296176809929
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MQA+zJFVAIgp/MQA+z2L290BFzk5h490/MQA+zq:MBaIMY/MV+z6p/MV+z2L290rzy490/Mz
                                                                                                                                                                                                                          MD5:861DAA3C2FFF1D3E9F81FB5C63EA71F1
                                                                                                                                                                                                                          SHA1:8E219E63E6D7E702FD0644543E05778CE786601A
                                                                                                                                                                                                                          SHA-256:1D32F22CF50C7586CB566E45988CA05538E61A05DF09FD8F824D870717832307
                                                                                                                                                                                                                          SHA-512:71B47C369DF1958C560E71B114616B999FB4B091FAA6DD203B29D2555FFE419D6FC5EF82FA810DC56E6F00722E13B03BFBED2516B4C5C2321F21E03F0198B91B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Buenos_Aires)]} {. LoadTimeZoneFile America/Argentina/Buenos_Aires.}.set TZData(:America/Buenos_Aires) $TZData(:America/Argentina/Buenos_Aires).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7487
                                                                                                                                                                                                                          Entropy (8bit):3.787618233072156
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OGoGm+4ILQzXN+C2mWBNQMsmNTxf6AeO+cblX:P7YUC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:839C797E403B4C102D466B1E759A6CC4
                                                                                                                                                                                                                          SHA1:D95864FF269AD16B35CDAAC95AE03D8306B8DE1F
                                                                                                                                                                                                                          SHA-256:37E219C4C7AEBCC8919293114280A247E8072F2760E69F083E9FDD6BE460B9BC
                                                                                                                                                                                                                          SHA-512:A74F3B3C83815F62F6BDF4199EA471872AE539D6C0C595BA41E6D2DF033075D74CC00995C8F99C3ADD4B1E5E04A12D663BE9BED4CE600FC5F067D7CDDED4D7F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cambridge_Bay) {. {-9223372036854775808 0 0 -00}. {-1577923200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7652
                                                                                                                                                                                                                          Entropy (8bit):3.4267759764212906
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ylD7ZYOtu7D/fVLF5H1RuSFuY66DCM/rDAWicDqRp5RepgK3i8kmmkniko1Kg+R7:n4jF17vArp
                                                                                                                                                                                                                          MD5:87CB052D17717B696F3D9158B237E4FB
                                                                                                                                                                                                                          SHA1:79B3947A50ED15C908CFC2D699D2B7F11468E7B2
                                                                                                                                                                                                                          SHA-256:113E8ADCECE14A96261A59E0C26073EA5CFF864C4FF2DA6FAB5C61129A549043
                                                                                                                                                                                                                          SHA-512:2BF788FD51E7268A1989F1C564E7B81B002B876381AEC561564D4BCE8D76C9D3F621A2F1AB26C1EAB5E5C64A3C41A536A1E21A5322D678CB11CB608333515144
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Campo_Grande) {. {-9223372036854775808 -13108 0 LMT}. {-1767212492 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {592977600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1365
                                                                                                                                                                                                                          Entropy (8bit):3.9551252054637245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQseeRb/uyV3XVP/upG/u/yRXiSn/Q8Sn/mfSn/yISn/PSn/zI3Sn/RSn/lfSn/A:5i7XEaRyM/BM/mfM/1M/PM/zmM/RM/l/
                                                                                                                                                                                                                          MD5:2EC91D30699B64FA8199004F97C63645
                                                                                                                                                                                                                          SHA1:4C4E00857B1FB3970E7C16C4EFAA9347ED2C3629
                                                                                                                                                                                                                          SHA-256:4EB4C729FF11E170D683310422D8F10BCE78992CF13DACCB06662308C76CCA3B
                                                                                                                                                                                                                          SHA-512:D7811C32E4D2B3B9FAEE730D580BC813EC41B63765DE34BB3A30A0D9BBEF2F090E2DA59C6D9A4D8FC91885DDEA2B6E3B1FD3FD434E42D805AF66E578E66AE6FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cancun) {. {-9223372036854775808 -20824 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {828860400 -14400 1 EDT}. {846396000 -18000 0 EST}. {860310000 -14400 1 EDT}. {877845600 -18000 0 EST}. {891759600 -14400 1 EDT}. {902041200 -18000 0 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):274
                                                                                                                                                                                                                          Entropy (8bit):4.527582804527589
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52909+ET2m2OHXP8Hk4lvFVFQVgIUF/R/OGWnVVFQVg2vR/O9:MBp5290QmdHXPy/ltvAYFZ/OGqVvA9/K
                                                                                                                                                                                                                          MD5:D47486658B408AAF7F91569435B49D19
                                                                                                                                                                                                                          SHA1:C69EDC17F2E77723A5C711342822BF21ECCB9C8E
                                                                                                                                                                                                                          SHA-256:555A66624909220ACCCB35D852079D44944E188A81DF6A07CBA7433AC2478E5E
                                                                                                                                                                                                                          SHA-512:35A4AF702405BD36F6EF7E42F1E1AEAD841A5710D04306C1C3390B3CC134E88F1221F284F489F6926C58E8FD50BD7E6BE0E5904AAE2ACBEA817EFCE0AAE61169
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Caracas) {. {-9223372036854775808 -16064 0 LMT}. {-2524505536 -16060 0 CMT}. {-1826739140 -16200 0 -0430}. {-157750200 -14400 0 -04}. {1197183600 -16200 0 -0430}. {1462086000 -14400 0 -04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):222
                                                                                                                                                                                                                          Entropy (8bit):4.615632762186706
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MMXAIVAIgp/MMXs29094SXAFB5290/MMXAv:MBaIMY/Mhp/MP290mh5290/MH
                                                                                                                                                                                                                          MD5:359226FA8A7EAFCA0851F658B4EBBCDC
                                                                                                                                                                                                                          SHA1:611A24C24462DF5994B5D043E65770B778A6443B
                                                                                                                                                                                                                          SHA-256:F2782781F1FB7FD12FF85D36BB244887D1C2AD52746456B3C3FEAC2A63EC2157
                                                                                                                                                                                                                          SHA-512:6F9DD2D1662103EC5A34A8858BDFA69AC9F74D3337052AB47EA61DC4D76216886A0644CF1284940E8862A09CBA3E0A87784DFDB6414434C92E45004AAF312614
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Catamarca)]} {. LoadTimeZoneFile America/Argentina/Catamarca.}.set TZData(:America/Catamarca) $TZData(:America/Argentina/Catamarca).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.781235086647991
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52IAcGE91pkXGm2OHEFvpoevUdR4FIUPvGDUwXvp3VVFVGHC:SlSWB9X52909zm2OHEdGeG4vOIw/ZVVF
                                                                                                                                                                                                                          MD5:1FFD7817EE1DC55EF72AD686749AE9CE
                                                                                                                                                                                                                          SHA1:AE972D5395F3562F052780AD014BA2C0767943B6
                                                                                                                                                                                                                          SHA-256:9CE77C0A01BFDA002EE3B2DCEF316DB7C9AC80B270DFC3A0D7769021E731D849
                                                                                                                                                                                                                          SHA-512:480D8D56F7B8829F6E82D8AFF1A0A161C3C45402D85A588027E98F2FA20C6E6F35549FFC5F38F0EEA9C4190A70B334066FCD406D39FF06EE7B7855AF75CD0FC3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cayenne) {. {-9223372036854775808 -12560 0 LMT}. {-1846269040 -14400 0 -04}. {-71092800 -10800 0 -03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.723325073771884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0u55DdVAIg20u5AF2IAcGE91mr4IAcGEu5un:SlSWB9IZaM3y7oDdVAIgpX2909Yr490/
                                                                                                                                                                                                                          MD5:E03755B574F4962030DB1E21D1317963
                                                                                                                                                                                                                          SHA1:5B5FA4787DA7AE358EFEA81787EB2AB48E4D7247
                                                                                                                                                                                                                          SHA-256:8E85F05135DB89CB304689081B22535002DBD184D5DCDBF6487CD0A2FBE4621E
                                                                                                                                                                                                                          SHA-512:8B85E51BD8DC04AE768A4D42F8DF0E0D60F23FAB2607E3DCAD4E10695E50C2A3F2124DA7E3A87E97DB7AF090EF70C9A5B5C2D34F7D1B6F74FEFEA9148FEB15AB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Panama)]} {. LoadTimeZoneFile America/Panama.}.set TZData(:America/Cayman) $TZData(:America/Panama).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11003
                                                                                                                                                                                                                          Entropy (8bit):3.728817385585057
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzURWu3OabMQxXI6X8x3X3D2DgOMIOdXkqq:rXxbWziyUZB4ME9Hmp7EYQYMWUJ2eQzg
                                                                                                                                                                                                                          MD5:6175956F3052F3BE172F6110EF6342EE
                                                                                                                                                                                                                          SHA1:532E2600DFAFAACCD3A187A233956462383401A6
                                                                                                                                                                                                                          SHA-256:FC172494A4943F8D1C3FC35362D96F3D12D6D352984B93BC1DE7BDCB7C85F15E
                                                                                                                                                                                                                          SHA-512:36B47003183EB9D7886F9980538DB3BDDC231BB27D4F14006CDBE0CB9042215A02559D97085679F8320DED6109FC7745DC43859EBA99B87365B09C4526D28193
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chicago) {. {-9223372036854775808 -21036 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-1563724800 -18000 1 CDT}. {-1551632400 -21600 0 CST}. {-1538928000 -18000 1 CDT}. {-1520182800 -21600 0 CST}. {-1504454400 -18000 1 CDT}. {-1491757200 -21600 0 CST}. {-1473004800 -18000 1 CDT}. {-1459702800 -21600 0 CST}. {-1441555200 -18000 1 CDT}. {-1428253200 -21600 0 CST}. {-1410105600 -18000 1 CDT}. {-1396803600 -21600 0 CST}. {-1378656000 -18000 1 CDT}. {-1365354000 -21600 0 CST}. {-1347206400 -18000 1 CDT}. {-1333904400 -21600 0 CST}. {-1315152000 -18000 1 CDT}. {-1301850000 -21600 0 CST}. {-1283702400 -18000 1 CDT}. {-1270400400 -21600 0 CST}. {-1252252800 -18000 1 CDT}. {-1238950800 -21600 0 CST}. {-1220803200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6593
                                                                                                                                                                                                                          Entropy (8bit):3.795313170000037
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:LJNfzBT8tRkfKxhzY720zaOXmlITHjLc1cb:dN18tRkfKv+2wB9h
                                                                                                                                                                                                                          MD5:B0CA4CFF6571AFBFF25FAC72CDDB5B08
                                                                                                                                                                                                                          SHA1:1BF3ACEC369AEA504AAA248459A115E61CF79C4B
                                                                                                                                                                                                                          SHA-256:C689A3BEED80D26EAB96C95C85874428F80699F7E136A44377776E52B5855D00
                                                                                                                                                                                                                          SHA-512:398496EBA4344EDF78AFBF51BD6024481D3A12546D0EE597B7C593A1CD1BF575AFDE62FFADE7A0DDFEDA79CF235612E6F4DA74D7305A6E48F5942EA10D8A4F8E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Chihuahua) {. {-9223372036854775808 -25460 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -25
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):4.822360211437507
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/qlfSwFVAIgp/qlfAvt2909qEac90/qlfu:MBaIMY/TwQp/tvt290Fac90/j
                                                                                                                                                                                                                          MD5:2541EC94D1EA371AB1361118EEC98CC6
                                                                                                                                                                                                                          SHA1:950E460C1BB680B591BA3ADA0CAA73EF07C229FE
                                                                                                                                                                                                                          SHA-256:50E6EE06C0218FF19D5679D539983CEB2349E5D25F67FD05E142921431DC63D6
                                                                                                                                                                                                                          SHA-512:2E6B66815565A9422015CAB8E972314055DC4141B5C21B302ABD671F30D0FBAE1A206F3474409826B65C30EDBEDD46E92A99251AB6316D59B09FC5A8095E7562
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Atikokan)]} {. LoadTimeZoneFile America/Atikokan.}.set TZData(:America/Coral_Harbour) $TZData(:America/Atikokan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):214
                                                                                                                                                                                                                          Entropy (8bit):4.74004515366486
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MdVAIgp/MOF29093+90/Msn:MBaIMY/M4p/MOF290c90/Ms
                                                                                                                                                                                                                          MD5:89870B2001C2EE737755A692E7CA2F18
                                                                                                                                                                                                                          SHA1:F67F6C22BF681C105068BEEB494A59B3809C5ED8
                                                                                                                                                                                                                          SHA-256:38C3DD7DAF75DBF0179DBFC387CE7E64678232497AF0DACF35DC76050E9424F7
                                                                                                                                                                                                                          SHA-512:EFA8A5A90BE6FAAA7C6F5F39CBBBA3C7D44C7943E1BB1B0F7E966FEE4F00F0E4BF1D999A377D4E5230271B120B059EB020BD93E7DA46CF1FFA54AB13D7EC3FFE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Cordoba) $TZData(:America/Argentina/Cordoba).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):416
                                                                                                                                                                                                                          Entropy (8bit):4.443696146912203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290l0TmdHd5PZ6kibvI8/uFn/mSU/uFn/i/uFn/4Y8/uFn//DVn:cQmAed9Z6n5Sn/mtSn/iSn/4JSn/bh
                                                                                                                                                                                                                          MD5:D47A1FBA5AD701E1CA168A356D0DA0A9
                                                                                                                                                                                                                          SHA1:6738EA6B4F54CC76B9723917AA373034F6865AF1
                                                                                                                                                                                                                          SHA-256:51F08C1671F07D21D69E2B7868AA5B9BDBFA6C31D57EB84EB5FF37A06002C5CD
                                                                                                                                                                                                                          SHA-512:DB6AD81466500F22820941DF3369155BA03CFA42FA9D267984A28A6D15F88E1A71625E3DC578370B5F97727355EBB7C338482FA33A7701ADB85A160C09BAD232
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Costa_Rica) {. {-9223372036854775808 -20173 0 LMT}. {-2524501427 -20173 0 SJMT}. {-1545071027 -21600 0 CST}. {288770400 -18000 1 CDT}. {297234000 -21600 0 CST}. {320220000 -18000 1 CDT}. {328683600 -21600 0 CST}. {664264800 -18000 1 CDT}. {678344400 -21600 0 CST}. {695714400 -18000 1 CDT}. {700635600 -21600 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):211
                                                                                                                                                                                                                          Entropy (8bit):4.798554218839104
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52909ovTm2OHpcHvvPagcyEXC/vHcQCi:MBp52900mdHpcHPagPECvHl
                                                                                                                                                                                                                          MD5:9E3726148A53940507998FA1A5EEE6DB
                                                                                                                                                                                                                          SHA1:2493B72DF895ED2AE91D09D43BDDADDB41E4DEBC
                                                                                                                                                                                                                          SHA-256:E809F227E92542C6FB4BAC82E6079661EEF7700964079AA4D7E289B5B400EC49
                                                                                                                                                                                                                          SHA-512:F5ED4085160A06DE672DB93CEE700C420D0438DE9AC3548B291DA236AA8CCC84F97270DA3956E49432AE1E281CCECEB6DF92E71EB305106655B4DF231E04B558
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Creston) {. {-9223372036854775808 -27964 0 LMT}. {-2713882436 -25200 0 MST}. {-1680454800 -28800 0 PST}. {-1627833600 -25200 0 MST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7646
                                                                                                                                                                                                                          Entropy (8bit):3.4194836403778353
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:+lD7ZYOtu7D/fVLF5H1RuSFuY66DCVDAWicDqRp5RepgK3i8kmmkniko1Kg+R4hu:3jF17vArp
                                                                                                                                                                                                                          MD5:7309EBE8210C3C84C24D459289484EFA
                                                                                                                                                                                                                          SHA1:31EFE19E3CA2DB512C7AC9CAFD72991EF0517FD3
                                                                                                                                                                                                                          SHA-256:FE7543FF576D7EDC3A3FF82759E5C244DE8EB57A95744E20610CEDF6E29AB4C9
                                                                                                                                                                                                                          SHA-512:41C94E4093F015B61ACEFCEA067C101AA1ECB855789CFDB8FA4D17589D20868FB7A1456D21C90B5261445D970E5E7F134CBAF17EA926278C9E6DFC471D29F896
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Cuiaba) {. {-9223372036854775808 -13460 0 LMT}. {-1767212140 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {592977600 -1080
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.858195118945703
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52IAcGE9CvjEwcXGm2OHCevUd5xF9vFVFIVgYd/iQG3VFpRR/r:SlSWB9X52909C4wTm2OHjyxzFQVgIUFp
                                                                                                                                                                                                                          MD5:CE0F18F27502E771B27236C5BF7D3317
                                                                                                                                                                                                                          SHA1:D2E68415B8544A8BAC2A4F335854FC048BD4B34C
                                                                                                                                                                                                                          SHA-256:118EC9D89937FDA05FCE45F694F8C3841664BBE9DFADB86347B375BF437F9BD6
                                                                                                                                                                                                                          SHA-512:B04B5DAB30384FF05ABFC235DA4F9BFE96F400076DEB7CBBA0938F93E66BFF5E86B18E95E9BC0448D812722C8F2D4AFD78AC75180FD80D992F96DFA0CEC156AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Curacao) {. {-9223372036854775808 -16547 0 LMT}. {-1826738653 -16200 0 -0430}. {-157750200 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1089
                                                                                                                                                                                                                          Entropy (8bit):3.793747183330894
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQZefXQgiu2kPIw1Dtc7UXxH9vC0gdtiyW8RWK79ET7cSXKIuXvY:52XQgiu2kgw1DtuyxdvC0gdtiyW8RB7S
                                                                                                                                                                                                                          MD5:E83072C1351121C5CFD74E110ECA9B4B
                                                                                                                                                                                                                          SHA1:360B468851EBFF266E4A8F40FE5D196BC6809E65
                                                                                                                                                                                                                          SHA-256:6A12AD52CBCF0B3F8BB449C7BC51A784BE560F4BD13545D04426E76B2511D8F9
                                                                                                                                                                                                                          SHA-512:539C53AA1D02E3AABF65873CA830782697AC9D55EC6694B68B95C325608F8703882B1182215D2B4E2B6066784AC880BCF0F4EBC5A72B2E637BD9B2C3A61D2979
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Danmarkshavn) {. {-9223372036854775808 -4480 0 LMT}. {-1686091520 -10800 0 -03}. {323845200 -7200 0 -02}. {338950800 -10800 0 -03}. {354675600 -7200 1 -02}. {370400400 -10800 0 -03}. {386125200 -7200 1 -02}. {401850000 -10800 0 -03}. {417574800 -7200 1 -02}. {433299600 -10800 0 -03}. {449024400 -7200 1 -02}. {465354000 -10800 0 -03}. {481078800 -7200 1 -02}. {496803600 -10800 0 -03}. {512528400 -7200 1 -02}. {528253200 -10800 0 -03}. {543978000 -7200 1 -02}. {559702800 -10800 0 -03}. {575427600 -7200 1 -02}. {591152400 -10800 0 -03}. {606877200 -7200 1 -02}. {622602000 -10800 0 -03}. {638326800 -7200 1 -02}. {654656400 -10800 0 -03}. {670381200 -7200 1 -02}. {686106000 -10800 0 -03}. {701830800 -7200 1 -02}. {717555600 -10800 0 -03}. {733280400 -7200 1 -02}. {749005200 -10800 0 -03}. {764730000 -7200 1 -02}. {780454800 -10800 0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7609
                                                                                                                                                                                                                          Entropy (8bit):3.785302701923574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nxr+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:nx/Nf+aNwj/lpmlOxnKcndIG
                                                                                                                                                                                                                          MD5:4DBA9C83ECAD5B5A099CC1AA78D391B0
                                                                                                                                                                                                                          SHA1:FFCC77D7964BD16BD8A554FB437BCF4F2FC8958E
                                                                                                                                                                                                                          SHA-256:3A89A6834DDBE4A3A6A1CB8C1A1F9579259E7FD6C6C55DE21DCD4807753D8E48
                                                                                                                                                                                                                          SHA-512:21212AFE8917C0F3BBED433B510C4FCE671B0DA887A1C7338A18CD5409B1A95E766510A9E636E5AA3AB0BA21D7D2C00A462FEBB10D4567A343B85AFE6A3E2394
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson) {. {-9223372036854775808 -33460 0 LMT}. {-2188996940 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1 PDT}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1876
                                                                                                                                                                                                                          Entropy (8bit):3.9458112723626755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ4eJ58IlJ14RsT8X+km8VnynhBZ2c4Y+O4A5W5xDICW2n7oZA8QZFaIOvkty1H2:5DH0yIRkf12fZGJ5LB6xfZ89Y
                                                                                                                                                                                                                          MD5:D7E4978775F290809B7C042674F46903
                                                                                                                                                                                                                          SHA1:E94DB1EBB6A1594ED1A5AEA48B52395482D06085
                                                                                                                                                                                                                          SHA-256:2E6CFFE8E0C1FE93F55B1BD01F96AA1F3CE645BC802C061CB4917318E30C4494
                                                                                                                                                                                                                          SHA-512:1FF3CD58A4C4DEC7538F0816E93E6577C51B0045CF36190FF4D327E81FB8282ADDB0EF20BD78A838ABD507EBAD1C187F2A20CC7840E2325B9C326EC449897B45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Dawson_Creek) {. {-9223372036854775808 -28856 0 LMT}. {-2713881544 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8629
                                                                                                                                                                                                                          Entropy (8bit):3.76966035849006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:4cGbc2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:4c2dVUC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:F641A7F5DE8FCF4ADC1E5A1A2C9DEC53
                                                                                                                                                                                                                          SHA1:B013EBBE8002C91C0C45A2D389245A1A9194077A
                                                                                                                                                                                                                          SHA-256:DF5459068DB3C771E41BE8D62FB89A2822CB2A33CF9A5640C6C666AB20ECE608
                                                                                                                                                                                                                          SHA-512:C2EA07FF21FD6D1A45A87C6AD85DD3929C2B56E66A52D23103DDFF7B2B3B6433EC5EBFC17BED0F9C0A9AF036F0DF965E12EA3D4463207A128AEF5F6BC12970D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Denver) {. {-9223372036854775808 -25196 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-1577898000 -25200 0 MST}. {-1570374000 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1538924400 -21600 1 MDT}. {-1534089600 -25200 0 MST}. {-883587600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-757357200 -25200 0 MST}. {-147884400 -21600 1 MDT}. {-131558400 -25200 0 MST}. {-116434800 -21600 1 MDT}. {-100108800 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8010
                                                                                                                                                                                                                          Entropy (8bit):3.742999180017181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:FVzApQaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:FVspQrn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:177B0815E8BD6BFA6E62895FE12A61E5
                                                                                                                                                                                                                          SHA1:EC2400FA644023D6B3100B52381DB65EAF2606F0
                                                                                                                                                                                                                          SHA-256:402EC5AB0E99EF6EBB33F4D482EEA5198EC686C7EAE75FC4F7D9B4EF4AC0A9E9
                                                                                                                                                                                                                          SHA-512:CFA4226A21FDB23C723335F7385EA15436D8A0752EE50C67DA4C1D839BFFD4792EE9AB6E408498CD06C6B8A99A96E95E0B591F7EA17B41C1895ED396438C6D5A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Detroit) {. {-9223372036854775808 -19931 0 LMT}. {-2051202469 -21600 0 CST}. {-1724083200 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-757364400 -18000 0 EST}. {-684349200 -14400 1 EDT}. {-671047200 -18000 0 EST}. {94712400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {157784400 -18000 0 EST}. {167814000 -14400 0 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):203
                                                                                                                                                                                                                          Entropy (8bit):4.856609165175433
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290TL3290e/:MBaIMY9QpI290Tr290O
                                                                                                                                                                                                                          MD5:F85ADC16127A74C9B35D16C631E11F4F
                                                                                                                                                                                                                          SHA1:F7716E20F546AA04697FB0F4993A14BAFDD1825E
                                                                                                                                                                                                                          SHA-256:67ACF237962E3D12E0C746AEDC7CDBC8579DC7C0A7998AC6B6E169C58A687C17
                                                                                                                                                                                                                          SHA-512:89E8F9DC6A306912B2DAEE77705E2DCD76E32F403352C23ED6BE34F8BEBB12C3604C20DA11DB921553D20E3FC43EC7984C7103D8D1396AB83B104E70BA6D13B1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Dominica) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8435
                                                                                                                                                                                                                          Entropy (8bit):3.7724320820194475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:7tGVgeb0Gm+qI1zXN+C2mWBNQMsmNTxf6AeO+cblX:7heJ/UC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:FECBDD64036247B2FBB723ADD8F798F6
                                                                                                                                                                                                                          SHA1:60B1719958AD6151CDB174A319A396D5F48C7CF1
                                                                                                                                                                                                                          SHA-256:EC95041E0A97B37A60EF16A6FA2B6BCB1EBEFABBC9468B828D0F467595132BC2
                                                                                                                                                                                                                          SHA-512:7CF94EC5040F4C8FA3C6ED30CFDAB59A199C18AA0CDA9A66D1A477F15563D2B7CB872CEEF1E2295E0F3B9A85508A03AEC29E3ECEBE11D9B089A92794D510BA00
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Edmonton) {. {-9223372036854775808 -27232 0 LMT}. {-1998663968 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1600614000 -21600 1 MDT}. {-1596816000 -25200 0 MST}. {-1567954800 -21600 1 MDT}. {-1551628800 -25200 0 MST}. {-1536505200 -21600 1 MDT}. {-1523203200 -25200 0 MST}. {-1504450800 -21600 1 MDT}. {-1491753600 -25200 0 MST}. {-1473001200 -21600 1 MDT}. {-1459699200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {136371600 -21600 1 MDT}. {152092800 -25200 0 MST}. {167821200 -21600 1 MDT}. {183542400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1189
                                                                                                                                                                                                                          Entropy (8bit):3.7118381376452767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQOX9eptXyss/u/C5/ukCI/uiCk/u8CHe/uOCXs/um4Co/uN3Cc/ux8CL/uiFCyL:5OXUCs5IlTToo4mdGFtapG8dtedJ9fO2
                                                                                                                                                                                                                          MD5:D6945DF73BA7E12D3B23889CC34F6CFB
                                                                                                                                                                                                                          SHA1:8C1317F3EF82225A14751318DFDA8904F908C457
                                                                                                                                                                                                                          SHA-256:71F15943EAD942224B8807CCBB21F9AE34F04619FD76176404633BDB49D9E88C
                                                                                                                                                                                                                          SHA-512:088C2D7BE44650A044B7632337A1FF8C3CF8A6188F24507C846B9B648FE796466B22D4A322B602B75C2943653FC43C7B9A99AE0AACF9AB7BCC86388EC3953F8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Eirunepe) {. {-9223372036854775808 -16768 0 LMT}. {-1767208832 -18000 0 -05}. {-1206950400 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1175367600 -14400 1 -05}. {-1159819200 -18000 0 -05}. {-633812400 -14400 1 -05}. {-622062000 -18000 0 -05}. {-602276400 -14400 1 -05}. {-591825600 -18000 0 -05}. {-570740400 -14400 1 -05}. {-560203200 -18000 0 -05}. {-539118000 -14400 1 -05}. {-531345600 -18000 0 -05}. {-191358000 -14400 1 -05}. {-184190400 -18000 0 -05}. {-155156400 -14400 1 -05}. {-150062400 -18000 0 -05}. {-128890800 -14400 1 -05}. {-121118400 -18000 0 -05}. {-99946800 -14400 1 -05}. {-89582400 -18000 0 -05}. {-68410800 -14400 1 -05}. {-57960000 -18000 0 -05}. {499755600 -14400 1 -05}. {511243200 -18000 0 -05}. {530600400 -14400 1 -05}. {540273600 -18000 0 -05}. {562136400 -14400 1 -05}. {571204800 -18000 0 -05}. {590040000 -18
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):269
                                                                                                                                                                                                                          Entropy (8bit):4.7060952459188305
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X529078iwTm2OHvJ4YRIgdrV/uFn/acD3/uFn/sVn:MBp5290785mdHx4YlB/uFn/z/uFn/U
                                                                                                                                                                                                                          MD5:77BE2E0759A3B7227B4DAC601A670D03
                                                                                                                                                                                                                          SHA1:1FB09211F291E5B1C5CC9848EB53106AF48EE830
                                                                                                                                                                                                                          SHA-256:40994535FE02326EA9E373F54CB60804BA7AE7162B52EA5F73497E7F72F2D482
                                                                                                                                                                                                                          SHA-512:EB5E6A4A912053E399F6225A02DDC524A223D4A5724165CAD9009F1FA10B042F971E52CE17B395A86BC80FCC6897FD2CCC3B00708506FEF39E4D71812F5DF595
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/El_Salvador) {. {-9223372036854775808 -21408 0 LMT}. {-1546279392 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.786739478919165
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo2IAcGE7JM7QIAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo2907390eu
                                                                                                                                                                                                                          MD5:74AB4664E80A145D808CAB004A22859B
                                                                                                                                                                                                                          SHA1:2AF7665C4E155A227B3F76D1C4BC87854C25A6CB
                                                                                                                                                                                                                          SHA-256:BDD0893AA5D170F388B1E93CE5FE2EDF438866707E52033E49898AFC499F86C5
                                                                                                                                                                                                                          SHA-512:CCC2E75E07BA1CAAFD1149A22D07668D191594272922AA2A1CE6DE628A8FF49AD90AA8BFE75C005328820C700B991AD87A6F40DEB5AD519B2708D8F7BF04E5A0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:America/Ensenada) $TZData(:America/Tijuana).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4427
                                                                                                                                                                                                                          Entropy (8bit):3.8109873978594053
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5aIl06OIRkf12fZGJ5LB6xfZ89Cf5udCLA9ZClqs/K+ff0t9:sIlWf/5LB6xR89C8CgZCHtffW9
                                                                                                                                                                                                                          MD5:90BBD338049233FAC5596CC63AA0D5B6
                                                                                                                                                                                                                          SHA1:D96282F5B57CBF823D5A1C1FDDE7907B74DAD770
                                                                                                                                                                                                                          SHA-256:DD21597BA97FD6591750E83CC00773864D658F32653017C4B52285670FFE52E3
                                                                                                                                                                                                                          SHA-512:3B0F5801E55EBBB7B4C0F74DDBD3469B8F4C2BFC1B44CC80B0D36DA2152C837C8176695945F61FA75664C04F1266BCA0564815307A2C27E783CD3348C4451E4A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fort_Nelson) {. {-9223372036854775808 -29447 0 LMT}. {-2713880953 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-725817600 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226
                                                                                                                                                                                                                          Entropy (8bit):4.730673843485836
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL290HXYAp4903GK1:MBaIMY3GK7Hp3GKBL290Hz4903GK1
                                                                                                                                                                                                                          MD5:4685E4E850E0B6669F72B8E1B4314A0A
                                                                                                                                                                                                                          SHA1:BC6CCD58A2977A1E125B21D7B8FD57E800E624E1
                                                                                                                                                                                                                          SHA-256:D35F335D6F575F95CEA4FF53382C0BE0BE94BE7EB8B1E0CA3B7C50E8F7614E4E
                                                                                                                                                                                                                          SHA-512:867003B33A5FC6E42D546FBFC7A8AB351DE72232B89BA1BEC6DB566F6DCE135E65C08DE9112837190EB21D677E2F83E7E0F6049EC70CB9E36F223DE3A68E000A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Fort_Wayne) $TZData(:America/Indiana/Indianapolis).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1375
                                                                                                                                                                                                                          Entropy (8bit):3.695923796037783
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQVeVc4h1u80V2dBUGphmC17ewGtN3rvIh0VBHZDIOXqWoN:5b4h19U2dBUGrmO7XGtN3kh0VBHZUwqX
                                                                                                                                                                                                                          MD5:2BCCE3C71898F3D7F2327419950C5838
                                                                                                                                                                                                                          SHA1:CE45568E951C227CB3D88D20B337E5E1E1D4B1EF
                                                                                                                                                                                                                          SHA-256:AA2CF8DA8D63FC4DE912A4F220CF7E49379021F5E51ABA1AFCFC7C9164D5A381
                                                                                                                                                                                                                          SHA-512:420066E5D39446AA53547CBF1A015A4745F02D1059B2530B7735AC4C28BD2BFC431AEB7531C2C49C2BDF8E31405F15717D88DE0DE3F5F42BAA96A8289A014D06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Fortaleza) {. {-9223372036854775808 -9240 0 LMT}. {-1767216360 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8099
                                                                                                                                                                                                                          Entropy (8bit):3.737123408653655
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:C1V2eXXnqvlrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kQ:CDJv
                                                                                                                                                                                                                          MD5:3A839112950BFDFD3B5FBD440A2981E4
                                                                                                                                                                                                                          SHA1:FFDF034F7E26647D1C18C1F6C49C776AD5BA93ED
                                                                                                                                                                                                                          SHA-256:3D0325012AB7076FB31A68E33EE0EABC8556DFA78FBA16A3E41F986D523858FF
                                                                                                                                                                                                                          SHA-512:1E06F4F607252C235D2D69E027D7E0510027D8DB0EE49CF291C39D6FD010868EF6899437057DA489DD30981949243DDFA6599FD07CE80E05A1994147B78A76CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Glace_Bay) {. {-9223372036854775808 -14388 0 LMT}. {-2131646412 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-536443200 -14400 0 AST}. {-526500000 -10800 1 ADT}. {-513198000 -14400 0 AST}. {-504907200 -14400 0 AST}. {63086400 -14400 0 AST}. {73461600 -10800 1 ADT}. {89182800 -14400 0 AST}. {104911200 -10800 1 ADT}. {120632400 -14400 0 AST}. {126244800 -14400 0 AST}. {136360800 -10800 1 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7186
                                                                                                                                                                                                                          Entropy (8bit):3.4539479411234977
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:HzC1RFbvHQbnRJ2N+f4hQAa3/paCxwPQg07VvN/W5ylGiGJ3G5cGKQWaT7dZV4gF:t5lfDARzJXC
                                                                                                                                                                                                                          MD5:F7C502D77495455080AC3125CE2B42EA
                                                                                                                                                                                                                          SHA1:B4883AF71068903AFA372DBFA9E73A39B658A8FF
                                                                                                                                                                                                                          SHA-256:058FBB47D5CD3001C0E5A0B5D92ACE1F8A720527A673A78AB71925198AC0ACA1
                                                                                                                                                                                                                          SHA-512:B0361D7FB7B02C996B9E608F9B8B1D8DB76FC7D298FA9AC841C4C51A0469FF05A06E0F7829E6C7D810D13BDF3B792A9547B70F6721CA9D7544CBD94028364CAB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Godthab) {. {-9223372036854775808 -12416 0 LMT}. {-1686083584 -10800 0 -03}. {323845200 -7200 0 -02}. {338950800 -10800 0 -03}. {354675600 -7200 1 -02}. {370400400 -10800 0 -03}. {386125200 -7200 1 -02}. {401850000 -10800 0 -03}. {417574800 -7200 1 -02}. {433299600 -10800 0 -03}. {449024400 -7200 1 -02}. {465354000 -10800 0 -03}. {481078800 -7200 1 -02}. {496803600 -10800 0 -03}. {512528400 -7200 1 -02}. {528253200 -10800 0 -03}. {543978000 -7200 1 -02}. {559702800 -10800 0 -03}. {575427600 -7200 1 -02}. {591152400 -10800 0 -03}. {606877200 -7200 1 -02}. {622602000 -10800 0 -03}. {638326800 -7200 1 -02}. {654656400 -10800 0 -03}. {670381200 -7200 1 -02}. {686106000 -10800 0 -03}. {701830800 -7200 1 -02}. {717555600 -10800 0 -03}. {733280400 -7200 1 -02}. {749005200 -10800 0 -03}. {764730000 -7200 1 -02}. {780454800 -10800 0 -03
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10015
                                                                                                                                                                                                                          Entropy (8bit):3.780383775128893
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:z9zdvd8mSGDcfnrpbXXMqvlrPGgFEUlpd8ESeYPiVFuT/eleWmBk81kS/kV6kefD:z9zdvd7SGgcESeYPiV2Jv
                                                                                                                                                                                                                          MD5:77DEEF08876F92042F71E1DEFA666857
                                                                                                                                                                                                                          SHA1:7E21B51B3ED8EBEB85193374174C6E2BCA7FEB7F
                                                                                                                                                                                                                          SHA-256:87E9C6E265BFA58885FBEC128263D5E5D86CC32B8FFEDECAFE96F773192C18BE
                                                                                                                                                                                                                          SHA-512:C9AB8C9147354A388AEC5FE04C6C5317481478A07893461706CDC9FD5B42E31733EAC01C95C357F3C5DC3556C49F20374F58A6E0A120755D5E96744DE3A95A81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Goose_Bay) {. {-9223372036854775808 -14500 0 LMT}. {-2713895900 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1096921748 -12600 0 NST}. {-1072989000 -12600 0 NST}. {-1061670600 -9000 1 NDT}. {-1048973400 -12600 0 NST}. {-1030221000 -9000 1 NDT}. {-1017523800 -12600 0 NST}. {-998771400 -9000 1 NDT}. {-986074200 -12600 0 NST}. {-966717000 -9000 1 NDT}. {-954624600 -12600 0 NST}. {-935267400 -9000 1 NDT}. {-922570200 -12600 0 NST}. {-903817800 -9000 1 NDT}. {-891120600 -12600 0 NST}. {-872368200 -9000 0 NWT}. {-769395600 -9000 1 NPT}. {-765401400 -12600 0 NST}. {-757369800 -12600 0 NST}. {-746044200 -9000 1 NDT}. {-733347000 -12600 0 NST}. {-714594600 -9000 1 NDT}. {-701897400 -12600 0 NST}. {-683145000 -9000 1 NDT}. {-670447800 -12600 0 NST}. {-6516954
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7307
                                                                                                                                                                                                                          Entropy (8bit):3.755018614919114
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:hrZaC3Xm8sHRyvOTFhP5S+ijFnRaJeaX1eyDt:htrn+cvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:8582299C1262010B6843306D65DB436C
                                                                                                                                                                                                                          SHA1:70DB6B507D7F51B1E2C96E087CD7987EB69E9A1D
                                                                                                                                                                                                                          SHA-256:7CFBA4D1B1E6106A0EC6D6B5600791D6A33AD527B7D47325C3AB9524B17B1829
                                                                                                                                                                                                                          SHA-512:CC12912C38D85B23242C69211BA2B58167C55836D51DB02E6D820CDBD6368F835893AF656FC81F73EA745FD786E9134EC4A3E8D325D1515A01540E8A7EBEF03B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Grand_Turk) {. {-9223372036854775808 -17072 0 LMT}. {-2524504528 -18430 0 KMT}. {-1827687170 -18000 0 EST}. {284014800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):202
                                                                                                                                                                                                                          Entropy (8bit):4.877543794488217
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX2905Qb90e/:MBaIMY9QpI290Ob90O
                                                                                                                                                                                                                          MD5:C62E81B423F5BA10709D331FEBAB1839
                                                                                                                                                                                                                          SHA1:F7BC5E7055E472DE33DED5077045F680843B1AA7
                                                                                                                                                                                                                          SHA-256:0806C0E907DB13687BBAD2D22CEF5974D37A407D00E0A97847EC12AF972BCFF3
                                                                                                                                                                                                                          SHA-512:7D7090C3A6FEBE67203EB18E06717B39EC62830757BAD5A40E0A7F97572ABB81E81CAB614AA4CD3089C3787DAA6293D6FED0137BB57EF3AE358A92FCDDCF52A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Grenada) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):205
                                                                                                                                                                                                                          Entropy (8bit):4.914669229343752
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX2905AJLr490e/:MBaIMY9QpI290qJLr490O
                                                                                                                                                                                                                          MD5:026A098D231C9BE8557A7F4A673C1BE2
                                                                                                                                                                                                                          SHA1:192EECA778E1E713053D37353AF6D3C168D2BFF5
                                                                                                                                                                                                                          SHA-256:FFE0E204D43000121944C57D2B2A846E792DDC73405C02FC5E8017136CD55BCB
                                                                                                                                                                                                                          SHA-512:B49BD0FC12CC8D475E7E5116B8BDEA1584912BFA433734451F4338E42B5E042F3EC259E81C009E85798030E21F658158FA9F4EFC60078972351F706F852425E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Guadeloupe) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):385
                                                                                                                                                                                                                          Entropy (8bit):4.450029420195016
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52906GdJmdHKznI2f/uFn/z/uFn/w67Rd3/uFn/4Bx/uFn/xAQ:cQ8JeQXfSn/zSn/w67Rd3Sn/4HSn/j
                                                                                                                                                                                                                          MD5:6E3FD9D19E0CD26275B0F95412F13F4C
                                                                                                                                                                                                                          SHA1:A1B6D6219DEBDBC9B5FFF5848E5DF14F8F4B1158
                                                                                                                                                                                                                          SHA-256:1DC103227CA0EDEEBA8EE8A41AE54B3E11459E4239DC051B0694CF7DF3636F1A
                                                                                                                                                                                                                          SHA-512:BF615D16BB55186AFC7216B47250EE84B7834FD08077E29E0A8F49C65AACAAD8D27539EA751202EBFF5E0B00702EC59B0A7D95F5FB585BFED68AC6206416110D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guatemala) {. {-9223372036854775808 -21724 0 LMT}. {-1617040676 -21600 0 CST}. {123055200 -18000 1 CDT}. {130914000 -21600 0 CST}. {422344800 -18000 1 CDT}. {433054800 -21600 0 CST}. {669708000 -18000 1 CDT}. {684219600 -21600 0 CST}. {1146376800 -18000 1 CDT}. {1159678800 -21600 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):240
                                                                                                                                                                                                                          Entropy (8bit):4.690879495223713
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X529056m2OHHjGeP5lahicKpKV91EX/uFkfF/KV9C:MBp5290smdHHLP5C/gO9U/uFEF/O9C
                                                                                                                                                                                                                          MD5:58E0902DC63F2F584AD72E6855A68BB8
                                                                                                                                                                                                                          SHA1:C8ED225C95DB512CB860D798E6AF648A321B82E7
                                                                                                                                                                                                                          SHA-256:D940627FFCBE6D690E34406B62EE4A032F116DF1AB81631E27A61E16BD4051E2
                                                                                                                                                                                                                          SHA-512:EF2523F2C55890BE4CE78DA2274833647587CF6F48B144C8261EB69B24BA73946B63244F03FEDF37A990FCAFECB2D88F4ECE302993F115C06323721E570EDD99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guayaquil) {. {-9223372036854775808 -19160 0 LMT}. {-2524502440 -18840 0 QMT}. {-1230749160 -18000 0 -05}. {722926800 -14400 1 -05}. {728884800 -18000 0 -05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):208
                                                                                                                                                                                                                          Entropy (8bit):4.687194013851928
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52905R3Lm2OHRjGeTShVy4yViUKcVVFAH/MIB/O9:MBp5290LLmdHVTiy4yVi7c/OH/MG/O9
                                                                                                                                                                                                                          MD5:CF5AD3AFBD735A42E3F7D85064C16AFC
                                                                                                                                                                                                                          SHA1:B8160F8D5E677836051643622262F13E3AE1B0BE
                                                                                                                                                                                                                          SHA-256:AF2EC2151402DF377E011618512BBC25A5A6AC64165E2C42212E2C2EC182E8F1
                                                                                                                                                                                                                          SHA-512:F69F10822AB115D25C0B5F705D294332FAAA66EB0BA2D98A6610A35E1FA5ED05F02B3DDBB4E37B9B4A77946C05E28C98113DBF11EDF8DB2661A2D8ED40711182
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Guyana) {. {-9223372036854775808 -13960 0 LMT}. {-1730578040 -13500 0 -0345}. {176010300 -10800 0 -03}. {662698800 -14400 0 -04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10763
                                                                                                                                                                                                                          Entropy (8bit):3.724988391778253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Y7Z1hubfVmv0SqJXDiFHrbm96qddObEn/RDzWRfQFQ4XL8vG+81VcfnrpbXXnqvo:823ZLYvuOZJv
                                                                                                                                                                                                                          MD5:7DE8E355A725B3D9B3FD06A838B9715F
                                                                                                                                                                                                                          SHA1:41C6AAEA03FC7FEED50CFFFC4DFF7F35E2B1C23D
                                                                                                                                                                                                                          SHA-256:5F65F38FFA6B05C59B21DB98672EB2124E4283530ACB01B22093EAEFB256D116
                                                                                                                                                                                                                          SHA-512:4C61A15DDF28124343C1E6EFE068D15E48F0662534486EC38A4E2731BE085CDA5856F884521EF32A6E0EDD610A8A491A722220BDD1BAF2A9652D8457778AF696
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Halifax) {. {-9223372036854775808 -15264 0 LMT}. {-2131645536 -14400 0 AST}. {-1696276800 -10800 1 ADT}. {-1680469200 -14400 0 AST}. {-1640980800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1609444800 -14400 0 AST}. {-1566763200 -10800 1 ADT}. {-1557090000 -14400 0 AST}. {-1535486400 -10800 1 ADT}. {-1524949200 -14400 0 AST}. {-1504468800 -10800 1 ADT}. {-1493413200 -14400 0 AST}. {-1472414400 -10800 1 ADT}. {-1461963600 -14400 0 AST}. {-1440964800 -10800 1 ADT}. {-1429390800 -14400 0 AST}. {-1409515200 -10800 1 ADT}. {-1396731600 -14400 0 AST}. {-1376856000 -10800 1 ADT}. {-1366491600 -14400 0 AST}. {-1346616000 -10800 1 ADT}. {-1333832400 -14400 0 AST}. {-1313956800 -10800 1 ADT}. {-1303678800 -14400 0 AST}. {-1282507200 -10800 1 ADT}. {-1272661200 -14400 0 AST}. {-1251057600 -10800 1 ADT}. {-1240088400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8444
                                                                                                                                                                                                                          Entropy (8bit):3.7372403334059547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:VXA0Bc0tTJtNliQ4sxgpuG4c2JPTxUw9Or2ocrPGSyM9Gk4LK46MCf7VkXgySCWv:VXA0Bc0tTJtNliQ4sxSuG4c2JPTxUw9F
                                                                                                                                                                                                                          MD5:C436FDCDBA98987601FEFC2DBFD5947B
                                                                                                                                                                                                                          SHA1:A04CF2A5C9468C634AED324CB79F9EE3544514B7
                                                                                                                                                                                                                          SHA-256:32F8B4D03E4ACB466353D72DAA2AA9E1E42D454DBBA001D0B880667E6346B8A1
                                                                                                                                                                                                                          SHA-512:56C25003685582AF2B8BA4E32EFF03EF10F4360D1A12E0F1294355000161ADDF7024CBD047D1830AB884BE2C385FD8ABE8DA5C30E9A0671C22E84EE3BF957D85
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Havana) {. {-9223372036854775808 -19768 0 LMT}. {-2524501832 -19776 0 HMT}. {-1402813824 -18000 0 CST}. {-1311534000 -14400 1 CDT}. {-1300996800 -18000 0 CST}. {-933534000 -14400 1 CDT}. {-925675200 -18000 0 CST}. {-902084400 -14400 1 CDT}. {-893620800 -18000 0 CST}. {-870030000 -14400 1 CDT}. {-862171200 -18000 0 CST}. {-775681200 -14400 1 CDT}. {-767822400 -18000 0 CST}. {-744231600 -14400 1 CDT}. {-736372800 -18000 0 CST}. {-144702000 -14400 1 CDT}. {-134251200 -18000 0 CST}. {-113425200 -14400 1 CDT}. {-102542400 -18000 0 CST}. {-86295600 -14400 1 CDT}. {-72907200 -18000 0 CST}. {-54154800 -14400 1 CDT}. {-41457600 -18000 0 CST}. {-21495600 -14400 1 CDT}. {-5774400 -18000 0 CST}. {9954000 -14400 1 CDT}. {25675200 -18000 0 CST}. {41403600 -14400 1 CDT}. {57729600 -18000 0 CST}. {73458000 -14400 1 CDT}. {87364800 -18000 0 CST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):595
                                                                                                                                                                                                                          Entropy (8bit):4.2803367804689785
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290ebmdH5NWw+Ux++vTQtFlvm0tFXtFjV5a:cQBe5gfUT7UFltF9FjV5a
                                                                                                                                                                                                                          MD5:9D1A1746614CE2CEE26D066182938CDC
                                                                                                                                                                                                                          SHA1:967590403A84E80ED299B8D548A2B37C8EEB21CE
                                                                                                                                                                                                                          SHA-256:493DB3E7B56B2E6B266A5C212CD1F75F1E5CF57533DA03BB1C1F2449543B9F48
                                                                                                                                                                                                                          SHA-512:DFAE6BC48F2E4B75DD6744AEE57D31D6A6E764D02DCA5731C7B516AD87B9BAB2FEB355A012EC38BDD53008B501B0744953EB7E0677F02B9EAF083D2E66042B37
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Hermosillo) {. {-9223372036854775808 -26632 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {915174000 -25200 0 MST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6996
                                                                                                                                                                                                                          Entropy (8bit):3.799188069575817
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:uRXxWMzJ2eQzURWu3N7sHRwvOTFhP5S+ijFnRaJeaX1eyDt:uRXxWUJ2eQzURWu3NOqvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:154A332C3ACF6D6F358B07D96B91EBD1
                                                                                                                                                                                                                          SHA1:FC16E7CBE179B3AB4E0C2A61AB5E0E8C23E50D50
                                                                                                                                                                                                                          SHA-256:C0C7964EBF9EA332B46D8B928B52FDE2ED15ED2B25EC664ACD33DA7BF3F987AE
                                                                                                                                                                                                                          SHA-512:5831905E1E6C6FA9DD309104B3A2EE476941D6FF159764123A477E2690C697B0F19EDEA0AD0CD3BBBECF96D64DC4B981027439E7865FCB1632661C8539B3BD6C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Indianapolis) {. {-9223372036854775808 -20678 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1577901600 -21600 0 CST}. {-900259200 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8470
                                                                                                                                                                                                                          Entropy (8bit):3.7546412701514034
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:AXxr2eQzURWu3Oab9BxXI6X8xYIIOdXkqbfkeTzZSJw5/9/yuvQ+hcr8bYkzbXw6:AXxr2eQzUwu3Oab9BxXI6XUYIIOdXkqv
                                                                                                                                                                                                                          MD5:E8AFD9E320A7F4310B413F8086462F31
                                                                                                                                                                                                                          SHA1:7BEE624AAC096E9C280B4FC84B0671381C657F6C
                                                                                                                                                                                                                          SHA-256:BE74C1765317898834A18617352DF3B2952D69DE4E294616F1554AB95824DAF0
                                                                                                                                                                                                                          SHA-512:C76620999A293FA3A93CA4615AB78F19395F12CC08C242F56BFD4C4CAF8BC769DDEBF33FF10F7DA5A3EFD8ED18792362780188636075419014A8C099A897C43C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Knox) {. {-9223372036854775808 -20790 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-725824800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-415818000 -21600 0 CST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7037
                                                                                                                                                                                                                          Entropy (8bit):3.786429098558221
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:FXx3knO559B18XWRh0ksHRwvOTFhP5S+ijFnRaJeaX1eyDt:FXxUnO559B2XWRh0pqvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:456422A0D5BE8FBF5DBD0E75D8650894
                                                                                                                                                                                                                          SHA1:737AC21F019A7E89689B9C8B465C8482FF4F403E
                                                                                                                                                                                                                          SHA-256:C92D86CACFF85344453E1AFBC124CE11085DE7F6DC52CB4CBE6B89B01D5FE2F3
                                                                                                                                                                                                                          SHA-512:372AEBB2F13A50536C36A025881874E5EE3162F0168B71B2083965BECBBFCA3DAC726117D205D708CC2B4F7ABE65CCC2B3FE6625F1403D97001950524D545470
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Marengo) {. {-9223372036854775808 -20723 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-599594400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7364
                                                                                                                                                                                                                          Entropy (8bit):3.79636789874872
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:pXxS559B2XW6X8x3X3D2D8IOdXkqbfkeTzlbaqvOTFhPI1jFIL:pXxS559B2XW6XU3X3D2D8IOdXkqbfNT2
                                                                                                                                                                                                                          MD5:9614153F9471187A2F92B674733369A0
                                                                                                                                                                                                                          SHA1:199E8D5018A374EDB9592483CE4DDB30712006E3
                                                                                                                                                                                                                          SHA-256:5323EBC8D450CC1B53AED18AD209ADEB3A6EEB5A00A80D63E26DB1C85B6476ED
                                                                                                                                                                                                                          SHA-512:2A1E26D711F62C51A5EE7014584FAF41C1780BD62573247D45D467500C6AB9A9EAD5A382A1986A9D768D7BB927E4D391EA1B7A4AD9A54D3B05D8AD2385156C33
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Petersburg) {. {-9223372036854775808 -20947 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-473364000 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-292438800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-257965200 -21600 0 CST}. {-242236800 -18000 1 CDT}. {-226515600 -21600 0 CST}. {-210787200 -18000 1 CDT}. {-195066000 -21600 0 CST}. {-179337600 -18000 1 CDT}. {-163616400 -21600 0 CST
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6992
                                                                                                                                                                                                                          Entropy (8bit):3.7768650637181533
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:CXxjL36559B2XI6XE3X3D2E0bYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3g:CXxjL36559B2XI6XE3X3D2E0bYkzbXw6
                                                                                                                                                                                                                          MD5:D0F40504B578D996E93DAE6DA583116A
                                                                                                                                                                                                                          SHA1:4D4D24021B826BFED2735D42A46EEC1C9EBEA8E3
                                                                                                                                                                                                                          SHA-256:F4A0572288D2073D093A256984A2EFEC6DF585642EA1C4A2860B38341D376BD8
                                                                                                                                                                                                                          SHA-512:BA9D994147318FF5A53D45EC432E118B5F349207D58448D568E0DB316452EF9FD620EE4623FD4EAD123BC2A6724E1BAE2809919C58223E6FD4C7A20F004155E0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Tell_City) {. {-9223372036854775808 -20823 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6350
                                                                                                                                                                                                                          Entropy (8bit):3.782861360101505
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:K9Xx3+lsHRwvOTFhP5S+ijFnRaJeaX1eyDt:6XxuoqvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:35A64C161E0083DCE8CD1E8E1D6EBE85
                                                                                                                                                                                                                          SHA1:9BC295C23783C07587D82DA2CC25C1A4586284B2
                                                                                                                                                                                                                          SHA-256:75E89796C6FB41D75D4DDA6D94E4D27979B0572487582DC980575AF6656A7822
                                                                                                                                                                                                                          SHA-512:7BAF735DA0DE899653F60EED6EEF53DD8A1ABC6F61F052B8E37B404BC9B37355E94563827BC296D8E980C4247864A57A117B7B1CB58A2C242991BBDC8FE7174E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vevay) {. {-9223372036854775808 -20416 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-495043200 -18000 0 EST}. {-31518000 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {1136091600 -18000 0 EST}. {1143961200 -14400 1 EDT}. {1162101600 -18000 0 EST}. {1173596400 -14400 1 EDT}. {1194156000 -18000 0 EST}. {1205046000 -14400 1 EDT}. {1225605600 -18000 0 EST}. {1236495600 -14400 1 EDT}. {1257055200 -18000 0 EST}. {1268550000 -14400 1 EDT}. {1289109600 -18000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6992
                                                                                                                                                                                                                          Entropy (8bit):3.795913753683276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:TXxjL36559B2XI6XE3X3D2E0baqvOTFhPI1jFIL:TXxjL36559B2XI6XE3X3D2E0bZ3+
                                                                                                                                                                                                                          MD5:AD8B44BD0DBBEB06786B2B281736A82B
                                                                                                                                                                                                                          SHA1:7480D3916F0ED66379FC534F20DC31001A3F14AF
                                                                                                                                                                                                                          SHA-256:18F35F24AEF9A937CD9E91E723F611BC5D802567A03C5484FAB7AEEC1F2A0ED0
                                                                                                                                                                                                                          SHA-512:7911EC3F1FD564C50DEAF074ED99A502A9B5262B63E3E0D2901E21F27E90FBD5656A53831E61B43A096BA1FF18BB4183CCCE2B903782C2189DAAFDD7A90B3083
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Vincennes) {. {-9223372036854775808 -21007 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-462996000 -18000 1 CDT}. {-450291600 -21600 0 CST}. {-431539200 -18000 1 CDT}. {-418237200 -21600 0 CST}. {-400089600 -18000 1 CDT}. {-386787600 -21600 0 CST}. {-368640000 -18000 1 CDT}. {-355338000 -21600 0 CST}. {-337190400 -18000 1 CDT}. {-323888400 -21600 0 CST}. {-305740800 -18000 1 CDT}. {-289414800 -21600 0 CST}. {-273686400 -18000 1 CDT}. {-260989200 -21600 0 CST}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7170
                                                                                                                                                                                                                          Entropy (8bit):3.7942292979267767
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:YXxjJ2eQzURWu3Oab9B2XWR0/qvOTFhPI1jFIL:YXxjJ2eQzUwu3Oab9B2XWR0M3+
                                                                                                                                                                                                                          MD5:40D8E05D8794C9D11DF018E3C8B8D7C0
                                                                                                                                                                                                                          SHA1:58161F320CB46EC72B9AA6BAD9086F18B2E0141B
                                                                                                                                                                                                                          SHA-256:A13D6158CCD4283FE94389FD341853AD90EA4EC505D37CE23BD7A6E7740F03F6
                                                                                                                                                                                                                          SHA-512:BC45B6EFF1B879B01F517D4A4012D0AFBA0F6A9D92E862EF9A960FE07CBE216C8C929FE790044C566DC95981EC4BEAB3DCBD45A1FE597606CF601214A78AEA08
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Indiana/Winamac) {. {-9223372036854775808 -20785 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620841600 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-447267600 -21600 0 CST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):228
                                                                                                                                                                                                                          Entropy (8bit):4.655121947675421
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y73GK7mFVAIgp3GKBL2903GfJ4903GK1:MBaIMY3GK7Hp3GKBL2903GfJ4903GK1
                                                                                                                                                                                                                          MD5:CB79BE371FAB0B0A5EBEB1BA101AA8BA
                                                                                                                                                                                                                          SHA1:6A24348AB24D6D55A8ABDEE1500ED03D5D1357F3
                                                                                                                                                                                                                          SHA-256:6AABF28AC5A766828DD91F2EE2783F50E9C6C6307D8942FCD4DFAE21DB2F1855
                                                                                                                                                                                                                          SHA-512:156E1E7046D7A0938FE4BF40BC586F0A7BEF1B0ED7B887665E9C6041980B511F079AA739B7BD42A89794CB9E82DB6629E81DD39D2F8161DFABDED539E272FB6E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:America/Indianapolis) $TZData(:America/Indiana/Indianapolis).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7389
                                                                                                                                                                                                                          Entropy (8bit):3.778898781146325
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:/ZGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:/EVUC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:EFEFB694C4F54583C0ED45A955E823AF
                                                                                                                                                                                                                          SHA1:6FF35D151E8E1DED0DC362671FFF904B3CFF59B4
                                                                                                                                                                                                                          SHA-256:72C48C0CCC1B8C1BD80E5BB5B8879A07A2DBE82317667568523BBE1F855E4883
                                                                                                                                                                                                                          SHA-512:52BDACF02C5A595927FF9B7DC0151367C81B259C8831A91F66A0C10D5271DCDF834763F44868CCF7EDA497295D9D55C49C8F8FD43EEC383C29BC3CABAA4B6B0F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Inuvik) {. {-9223372036854775808 0 0 -00}. {-536457600 -28800 0 PST}. {-147888000 -21600 1 PDDT}. {-131558400 -28800 0 PST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {688550400 -25200 0 MST}. {702464400 -21600 1 MDT}. {720000000 -25200 0 MST}. {733914000 -
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7421
                                                                                                                                                                                                                          Entropy (8bit):3.7475594770809835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:0/GC3XmzdsHRwvOTFhP5S+ijFnRaJeaX1eyDt:0/Pn0gqvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:67B9C859DCD38D60EB892500D7287387
                                                                                                                                                                                                                          SHA1:E91BE702B1D97039528A3F540D1FFFF553683CE9
                                                                                                                                                                                                                          SHA-256:34D907D9F2B36DC562DCD4E972170011B4DA98F9F6EDA819C50C130A51F1DBED
                                                                                                                                                                                                                          SHA-512:239B0BA842C1432DB5A6DE4E0A63CDE4B4800FC76AE237B0E723116426F0700FFF418634FB1B5641B87E7792709E16A9ED679E37A570E9D723E3561C2B6B45B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Iqaluit) {. {-9223372036854775808 0 0 -00}. {-865296000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-147898800 -10800 1 EDDT}. {-131569200 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}. {499240800 -18000 0 EST}. {514969200 -14400 1 EDT}. {530690400 -18000 0 EST}. {544604400 -14400 1 EDT}. {562140000 -18000 0 EST}. {576054000 -14400 1 EDT}. {594194400 -18000 0 EST}. {607503600 -14400 1 EDT}. {625644000 -18000 0 EST}. {638953200 -14400 1 EDT}. {657093600 -18000 0 EST}. {671007600 -14400 1 EDT}. {688543200 -18000 0 EST}. {702457200 -14400 1 EDT}. {71999280
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):818
                                                                                                                                                                                                                          Entropy (8bit):4.132568007446054
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ1ewtWFD/u/Ip/uJD/u2lR/utzN54i/uhU/ufUF5/uDBq/u63gU/u3Zh/u4u8H:5htWFYIgxmzfwuFqBG3g/k8H
                                                                                                                                                                                                                          MD5:5C35FFB7D73B7F46DB4A508CF7AB1C54
                                                                                                                                                                                                                          SHA1:5C631104044E9413C86F95E072A630C2AD9EA56D
                                                                                                                                                                                                                          SHA-256:7FDD008C250308942D0D1DE485B05670A6A4276CB61F5F052385769B7E1906C1
                                                                                                                                                                                                                          SHA-512:7B3FF2C945598DDBF43B0BD0650192D6C70B333BF89916013C35F56DC1489CB65A72BA70FB0AE7341C71A71D4B73805F9D597A5B5FA525F4BFB1DF0F582641AE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Jamaica) {. {-9223372036854775808 -18430 0 LMT}. {-2524503170 -18430 0 KMT}. {-1827687170 -18000 0 EST}. {126248400 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {441781200 -18000 0 EST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):206
                                                                                                                                                                                                                          Entropy (8bit):4.89710274358395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MI1VAIgp/MI+290pPGe90/MIE:MBaIMY/Mvp/Mh290h390/MB
                                                                                                                                                                                                                          MD5:320C83EFE59FD60EB9F5D4CF0845B948
                                                                                                                                                                                                                          SHA1:5A71DFAE7DF9E3D8724DFA533A37744B9A34FFEC
                                                                                                                                                                                                                          SHA-256:67740B2D5427CFCA70FB53ABD2356B62E01B782A51A805A324C4DFAD9ACA0CFA
                                                                                                                                                                                                                          SHA-512:D7A6378372386C45C907D3CB48B923511A719794B0C0BFA3694DBCE094A46A48249720653836C2F10CBB2178DD8EEEEA6B5019E4CC6C6B650FD7BE256BE1CA99
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Jujuy)]} {. LoadTimeZoneFile America/Argentina/Jujuy.}.set TZData(:America/Jujuy) $TZData(:America/Argentina/Jujuy).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8406
                                                                                                                                                                                                                          Entropy (8bit):3.8821515247187883
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:sL19jPaps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:sB9jPP/4h5sBPy+CMt/ElALLVuAH
                                                                                                                                                                                                                          MD5:7D338E0224E7DDC690766CDC3E436805
                                                                                                                                                                                                                          SHA1:89BB26B7731AC40DE75FFCD854BA4D30A0F1B716
                                                                                                                                                                                                                          SHA-256:B703FC5AA56667A5F27FD80E5042AFE0F22F5A7EF7C5174646B2C10297E16810
                                                                                                                                                                                                                          SHA-512:7B52EDD2FE3ECAB682138EC867B4D654A08BEA9C4A3BB20E1ED69F03DD9EF91A3B707C78D25CA5A32938152157E98188A253AD2D2D283EF24ECE7352BCB88B67
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Juneau) {. {-9223372036854775808 54139 0 LMT}. {-3225223727 -32261 0 LMT}. {-2188954939 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9332
                                                                                                                                                                                                                          Entropy (8bit):3.769996646995791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:wmXxSkUArUfxLURWu3O5bMQxXI6Xah0drn+qvOTFhPI1jFIL:wmXxSkUArUfxLUwu3O5bMQxXI6Xah2n8
                                                                                                                                                                                                                          MD5:D9BC20AFD7DA8643A2091EB1A4B48CB3
                                                                                                                                                                                                                          SHA1:9B567ABF6630E7AB231CAD867AD541C82D9599FF
                                                                                                                                                                                                                          SHA-256:B4CC987A6582494779799A32A9FB3B4A0D0298425E71377EB80E2FB4AAAEB873
                                                                                                                                                                                                                          SHA-512:0BC769A53E63B41341C25A0E2093B127064B589F86483962BD24DB4082C4466E12F4CD889B82AD0134C992E984EF0897113F28321522B57BA45A98C15FF7E172
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Louisville) {. {-9223372036854775808 -20582 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-1546279200 -21600 0 CST}. {-1535904000 -18000 1 CDT}. {-1525280400 -21600 0 CST}. {-905097600 -18000 1 CDT}. {-891795600 -21600 0 CST}. {-883591200 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-744224400 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-684349200 -18000 1 CDT}. {-652899600 -18000 1 CDT}. {-620845200 -18000 1 CDT}. {-608144400 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8279
                                                                                                                                                                                                                          Entropy (8bit):3.785637200740036
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jFPXxEOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+gqvOTFhPI1jFIL:5PXxEOdXkqbfNTzZSJw5/9/yuvQ6crD9
                                                                                                                                                                                                                          MD5:0C6F5C9D1514DF2D0F8044BE27080EE2
                                                                                                                                                                                                                          SHA1:70CBA0561E4319027C60FB0DCF29C9783BFE8A75
                                                                                                                                                                                                                          SHA-256:1515460FBA496FE8C09C87C51406F4DA5D77C11D1FF2A2C8351DF5030001450F
                                                                                                                                                                                                                          SHA-512:17B519BCC044FE6ED2F16F2DFBCB6CCE7FA83CF17B9FC4A40FDA21DEFBA9DE7F022A50CF5A264F3090D57D51362662E01C3C60BD125430AEECA0887BB8520DB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Kentucky/Monticello) {. {-9223372036854775808 -20364 0 LMT}. {-2717647200 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-63136800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199
                                                                                                                                                                                                                          Entropy (8bit):4.8191308888643345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y73GKXFVAIgp3GK4N2901iZ903GKk:MBaIMY3GKXQp3GKe290Q903GKk
                                                                                                                                                                                                                          MD5:465D405C9720EB7EC4BB007A279E88ED
                                                                                                                                                                                                                          SHA1:7D80B8746816ECF4AF45166AED24C731B60CCFC6
                                                                                                                                                                                                                          SHA-256:BE85C86FBD7D396D2307E7DCC945214977829E1314D1D71EFAE509E98AC15CF7
                                                                                                                                                                                                                          SHA-512:C476022D2CC840793BF7B5841051F707A30CCAB1022E30FB1E45B420077417F517BEDA5564EFB154283C7C018A9CA09D10845C6A1BFE2A2DE7C939E307BDCE6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:America/Knox_IN) $TZData(:America/Indiana/Knox).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.810917109656368
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGE1QOa0IAcGE9Cvju:SlSWB9IZaM3y79CzVAIgp9CE2901Qv0k
                                                                                                                                                                                                                          MD5:4763D6524D2D8FC62720BCD020469FF6
                                                                                                                                                                                                                          SHA1:EE567965467E4F3BDFE4094604E526A49305FDD8
                                                                                                                                                                                                                          SHA-256:A794B43E498484FFD83702CFB9250932058C01627F6F6F4EE1432C80A9B37CD6
                                                                                                                                                                                                                          SHA-512:37462E0A3C24D5BAEBDD1ADCF8EE94EA07682960D710D57D5FD05AF9C5F09FF30312528D79516A16A0A84A2D351019DBB33308FC39EC468033B18FB0AC872C13
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Kralendijk) $TZData(:America/Curacao).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):210
                                                                                                                                                                                                                          Entropy (8bit):4.853705210019575
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52IAcGEyUMWkXGm2OHpJvvvX+nFp1vZSsXxyFYMUmBXlVvG9:SlSWB9X5290Xm2OHphvPKZpyFMmBVVO9
                                                                                                                                                                                                                          MD5:FE113AA98220A177DA9DD5BF588EB317
                                                                                                                                                                                                                          SHA1:083F2C36FF97185E2078B389F6DB2B3B04E95672
                                                                                                                                                                                                                          SHA-256:AF2A931C2CC39EED49710B9AFDBB3E56F1E4A1A5B9B1C813565BE43D6668493A
                                                                                                                                                                                                                          SHA-512:B6A34966F4150E3E3785563DFEB543726868923DB3980F693B4F2504B773A6CFD4102225C24897C81F1B3D22F35D1BE92D5ECE19F03028AC485A6B975896BB8F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/La_Paz) {. {-9223372036854775808 -16356 0 LMT}. {-2524505244 -16356 0 CMT}. {-1205954844 -12756 1 BST}. {-1192307244 -14400 0 -04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):444
                                                                                                                                                                                                                          Entropy (8bit):4.171707948838632
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290BbmdH4VPvut/O9F/O9BQXR/uFEC3/O9Ge/uFAs/O92/O9PF/O9R8/O9Tu:cQye8mV6FC4R/u1Cp/u2sC2CdC6CTSPV
                                                                                                                                                                                                                          MD5:D20722EC3E24AA65C23DB94006246684
                                                                                                                                                                                                                          SHA1:3E9D446FFA6163ED658D947BB582C9F566374777
                                                                                                                                                                                                                          SHA-256:593FEBC924D0DE7DA5FC482952282F1B1E3432D7509798F475B13743047286DA
                                                                                                                                                                                                                          SHA-512:326E300C837981DEFC497B5E467EA70DC2F6F10765FAB39977A2F03F3BEF0A0917EFD0524E2B66CBCFE0EE424273594437E098C6503EFC73002673678016C605
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Lima) {. {-9223372036854775808 -18492 0 LMT}. {-2524503108 -18516 0 LMT}. {-1938538284 -14400 0 -05}. {-1002052800 -18000 0 -05}. {-986756400 -14400 1 -05}. {-971035200 -18000 0 -05}. {-955306800 -14400 1 -05}. {-939585600 -18000 0 -05}. {512712000 -18000 0 -05}. {544248000 -18000 0 -05}. {638942400 -18000 0 -05}. {765172800 -18000 0 -05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9409
                                                                                                                                                                                                                          Entropy (8bit):3.767062784666229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:lBY5PBFx/9jgNf+aNwj/lpmlOxnKcndIG:lBY5PBFx/9wfefnK6
                                                                                                                                                                                                                          MD5:A661407CC08E68459018A636C8EF0EC1
                                                                                                                                                                                                                          SHA1:5524A613B07C4B4CA7404504EAD917E5B0A00112
                                                                                                                                                                                                                          SHA-256:C39E5A4C1482B13E862B4D36F4F4590BDF230BE44BAC30BDAB015CDBE02BE9C9
                                                                                                                                                                                                                          SHA-512:F5BD08D99E0B54911AC3ABFD413A1D98A0EB7F39A41E348E17D38EA9226A9320BA0CFE9CEB0954D158AB9B8761F0A9ECFB6F82DF033CD9B2234BC71A2D163B3A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Los_Angeles) {. {-9223372036854775808 -28378 0 LMT}. {-2717640000 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-687967140 -25200 1 PDT}. {-662655600 -28800 0 PST}. {-620838000 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589388400 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557938800 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526489200 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495039600 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463590000 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431535600 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400086000 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368636400 -25200 1 PDT}. {-355330800 -28800 0 PST}. {
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):223
                                                                                                                                                                                                                          Entropy (8bit):4.866250035215905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y71PiKp4ozFVAIgp1PiKp4zL290hp4901PiKp4/:MBaIMYPyJpPyzL290P490Py/
                                                                                                                                                                                                                          MD5:3BAD2D8B6F2ECB3EC0BFA16DEAEBADC3
                                                                                                                                                                                                                          SHA1:2E8D7A5A29733F94FF247E7E62A7D99D5073AFDC
                                                                                                                                                                                                                          SHA-256:242870CE8998D1B4E756FB4CD7097FF1B41DF8AA6645E0B0F8EB64AEDC46C13C
                                                                                                                                                                                                                          SHA-512:533A6A22A11C34BCE3772BD85B6A5819CCCD98BF7ECED9E751191E5D1AD3B84F34D70F30936CFE501C2FA3F6AAC7ABB9F8843B7EB742C6F9C2AD4C22D5C73740
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Kentucky/Louisville)]} {. LoadTimeZoneFile America/Kentucky/Louisville.}.set TZData(:America/Louisville) $TZData(:America/Kentucky/Louisville).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.81236985301262
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx09CvjHVAIg209CvjvQ2IAcGEyOqdVM1h4IAcGE9Cva:SlSWB9IZaM3y79CzVAIgp9CE290h48hf
                                                                                                                                                                                                                          MD5:EBB062CC0AA5C21F7C4278B79B9EAE6C
                                                                                                                                                                                                                          SHA1:6DFC8303BBE1FB990D7CB258E7DBC6270A5CFE64
                                                                                                                                                                                                                          SHA-256:4842420076033349DD9560879505326FFAB91BED75D6C133143FFBBFB8725975
                                                                                                                                                                                                                          SHA-512:5087C6257CA797317D049424324F5DC31BBD938436DCEB4CF4FE3D2520F7745F1C023E3EC48689957E389900EF2AACB3F5E9E49FD154DF51FF89F9A7173818CD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Curacao)]} {. LoadTimeZoneFile America/Curacao.}.set TZData(:America/Lower_Princes) $TZData(:America/Curacao).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1487
                                                                                                                                                                                                                          Entropy (8bit):3.655866753080831
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQGEecc4h1u80V2dBUGphmC17ewGtN3rvIh0VKngBHZDIOXqWoN:5K4h19U2dBUGrmO7XGtN3kh0VKngBHZy
                                                                                                                                                                                                                          MD5:3BC7560FE4E357A36D53F6DCC1E6F176
                                                                                                                                                                                                                          SHA1:F9F647E5021344A3A350CD895A26B049331E7CF1
                                                                                                                                                                                                                          SHA-256:184EC961CA5D1233A96A030D75D0D47A4111717B793EE25C82C0540E25168BDD
                                                                                                                                                                                                                          SHA-512:0805146230F55E12D7524F3F4EDB53D9C6C41C6926FA0603B3958AA82E85C9531D8CBDF4DFF085189908F293A2B29FDFA1BAEFB0FDADF34134D6C4D2FCF19397
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Maceio) {. {-9223372036854775808 -8572 0 LMT}. {-1767217028 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}. {60
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):590
                                                                                                                                                                                                                          Entropy (8bit):4.233264210289004
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290znTsmdHOYPprva6/wLAyM/uFn/V8/uFn/3Y/oA2P/RASx/uFn/G/uFn/M:cQGnoeOshRIpMSn/V8Sn/3YVgJvxSn/6
                                                                                                                                                                                                                          MD5:6BF9AB156020E7AC62F93F561B314CB8
                                                                                                                                                                                                                          SHA1:7484A57EADCFD870490395BB4D6865A2E024B791
                                                                                                                                                                                                                          SHA-256:D45B4690B43C46A7CD8001F8AE950CD6C0FF7B01CD5B3623E3DD92C62FD5E473
                                                                                                                                                                                                                          SHA-512:CF02E62650679D8E2D58D0D70DE2322CAAA6508AF4FF7A60E415AA8AA3A9D26D1A191CFAE986ACAF0AEF1DFC4C2E34F9A5B6EDC2018E0B7E9000917D429FB587
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Managua) {. {-9223372036854775808 -20708 0 LMT}. {-2524500892 -20712 0 MMT}. {-1121105688 -21600 0 CST}. {105084000 -18000 0 EST}. {161758800 -21600 0 CST}. {290584800 -18000 1 CDT}. {299134800 -21600 0 CST}. {322034400 -18000 1 CDT}. {330584400 -21600 0 CST}. {694260000 -18000 0 EST}. {717310800 -21600 0 CST}. {725868000 -18000 0 EST}. {852094800 -21600 0 CST}. {1113112800 -18000 1 CDT}. {1128229200 -21600 0 CST}. {1146384000 -18000 1 CDT}. {1159682400 -21600 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1127
                                                                                                                                                                                                                          Entropy (8bit):3.6965365214193797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQGnveI8Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSjc:5rSaSwXS4SqSbS3JSySxSxcSESAlSQSk
                                                                                                                                                                                                                          MD5:BFCC0D7639AE2D973CDBD504E99A58B8
                                                                                                                                                                                                                          SHA1:E8C43C5B026891D3E9B291446ABC050E7A100C71
                                                                                                                                                                                                                          SHA-256:1237FF765AA4C5530E5250F928DFAB5BB687C72C990A37B87E9DB8135C5D9CBD
                                                                                                                                                                                                                          SHA-512:DAD87E612161A136606E50944C50401AFD4C11D51A016704BDD070E52ED3BAC56E0E7BCFD83E7DA392FC8D2278E5F9EF6C0C466372F58AFA1005C4156CDA189D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Manaus) {. {-9223372036854775808 -14404 0 LMT}. {-1767211196 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400 -1440
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):202
                                                                                                                                                                                                                          Entropy (8bit):4.890561068654966
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290zzJ/90e/:MBaIMY9QpI290zzN90O
                                                                                                                                                                                                                          MD5:3340CD9706ECBB2C6BCB16F1D75C5428
                                                                                                                                                                                                                          SHA1:FE230B53F0DCCE15C14C91F43796E46DA5C1A2CE
                                                                                                                                                                                                                          SHA-256:BC2F908758F074D593C033F7B1C7D7B4F81618A4ED46E7907CD434E0CCFEE9F4
                                                                                                                                                                                                                          SHA-512:016AB54B9E99600A296D99A036A555BB79E3C5FDB0F1BEB516AFFE17B7763D864CB076B9C2D95547ED44BA2F6FC372CDFF25708C5423E1CF643AB6F0AA78E0E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Marigot) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):242
                                                                                                                                                                                                                          Entropy (8bit):4.7982301339896285
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290zlJm2OHfueP9dMQR5OfT/VVFUFkCFeR/r:MBp5290znmdHfnP9dMQR5Gb/uFkCFO/r
                                                                                                                                                                                                                          MD5:2F7A1415403071E5D2E545C1DAA96A15
                                                                                                                                                                                                                          SHA1:6A8FB2ABAD2B2D25AF569624C6C9AAE9821EF70B
                                                                                                                                                                                                                          SHA-256:40F3C68A518F294062AC3DD5361BB9884308E1C490EF11D2CFDC93CB219C3D26
                                                                                                                                                                                                                          SHA-512:3E4D94AB6A46E6C3BB97304F3A5596A06041C0E0935CC840F4A6EB56D0892778F853959A742C5B832CD8F07AB9B74539C45599F22C080577503B2E34B6CE28C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Martinique) {. {-9223372036854775808 -14660 0 LMT}. {-2524506940 -14660 0 FFMT}. {-1851537340 -14400 0 AST}. {323841600 -10800 1 ADT}. {338958000 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6526
                                                                                                                                                                                                                          Entropy (8bit):3.7582526108760064
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:t+vN41+z6stuNEsRZLbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsr2:taN41+z6stuNEsRZLbXwDTIRqfh57TlE
                                                                                                                                                                                                                          MD5:2BBAA150389EAAE284D905A159A61167
                                                                                                                                                                                                                          SHA1:0001B50C25FC0CDF015A60150963AAF895EEDEEF
                                                                                                                                                                                                                          SHA-256:A7966B95DBE643291FB68E228B60E2DC780F8155E064D96B670C8290F104E4AB
                                                                                                                                                                                                                          SHA-512:87CE18E7E4C2C59A953CD47005EF406F4923730459996B1BF09B04FFD9CD5F963A9E50299ECCDBF4B24C565412B706B1ABC39890D659E6F409F1BA50308E57F9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Matamoros) {. {-9223372036854775808 -24000 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6619
                                                                                                                                                                                                                          Entropy (8bit):3.788952004807415
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:W7ezBT8tRkfKxhzY720zaOXmlITHjLc1cb:X8tRkfKv+2wB9h
                                                                                                                                                                                                                          MD5:4D63766E65BF3E772CCEC2D6DB3E2D3E
                                                                                                                                                                                                                          SHA1:DB541D2908159C7EF98F912D8DBC36755FFD13F3
                                                                                                                                                                                                                          SHA-256:81CEA4A397AF6190FD250325CF513976B3508209AE3A88FDFD55490A5016A36D
                                                                                                                                                                                                                          SHA-512:DFAF1B3547B1B1B78B33F1F0F5E9624C693492687EC5D060FC4C6CBE2AFBB61B2E9B618133636DD62364D28B2450F741561AADFDE7B811F579BBC7247343A041
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mazatlan) {. {-9223372036854775808 -25540 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-873828000 -25200 0 MST}. {-661539600 -28800 0 PST}. {28800 -25200 0 MST}. {828867600 -21600 1 MDT}. {846403200 -25200 0 MST}. {860317200 -21600 1 MDT}. {877852800 -25200 0 MST}. {891766800 -21600 1 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):214
                                                                                                                                                                                                                          Entropy (8bit):4.76389929825594
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MBVAIgp/Ma290zpH+90/MI:MBaIMY/Mcp/Ma290zpe90/MI
                                                                                                                                                                                                                          MD5:A6EFD8F443D4CB54A5FB238D4D975808
                                                                                                                                                                                                                          SHA1:8F25C6C0EA9D73DC8D1964C4A28A4E2E783880CC
                                                                                                                                                                                                                          SHA-256:39B34B406339F06A8D187F8CCC1B6BF2550E49329F7DCE223619190F560E75F8
                                                                                                                                                                                                                          SHA-512:4B5D48472D56AF19B29AD2377573CC8CB3ED9EF1AF53C00C907B6576FA852EA3D1E9F9B3A78A280DC44F8ADBE5B81D6AEC2609BE08FFA08507CD0F4139878F46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Mendoza)]} {. LoadTimeZoneFile America/Argentina/Mendoza.}.set TZData(:America/Mendoza) $TZData(:America/Argentina/Mendoza).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8136
                                                                                                                                                                                                                          Entropy (8bit):3.7460641906933345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:oXxj07ffkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvC:oXxj07ffNTzZSJw5/9/yuvQ6crD57X0w
                                                                                                                                                                                                                          MD5:0D0DC4A816CDAE4707CDF4DF51A18D30
                                                                                                                                                                                                                          SHA1:7ED2835AA8F723B958A6631092019A779554CADE
                                                                                                                                                                                                                          SHA-256:3C659C1EAC7848BBE8DF00F857F8F81D2F64B56BD1CEF3495641C53C007434FA
                                                                                                                                                                                                                          SHA-512:930F2FDC2C1EAE4106F9B37A16BCBBAF618A2CCBBA98C712E8215555CF09B9303D71842DEC38EFAF930DB71E14E8208B14E41E10B54EF98335E01435D0FC3518
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Menominee) {. {-9223372036854775808 -21027 0 LMT}. {-2659759773 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-757360800 -21600 0 CST}. {-747244800 -18000 1 CDT}. {-733942800 -21600 0 CST}. {-116438400 -18000 1 CDT}. {-100112400 -21600 0 CST}. {-21484800 -18000 0 EST}. {104914800 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6435
                                                                                                                                                                                                                          Entropy (8bit):3.757504464563519
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:gN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOVEmR:gN41+z6stuNEsRZjWqZL/1dCYDDCxyHo
                                                                                                                                                                                                                          MD5:A7C5CFE3FA08D4CEDF6324457EA5766E
                                                                                                                                                                                                                          SHA1:83BB96398C0B1B34771940C8F7A19CB78C5EF72F
                                                                                                                                                                                                                          SHA-256:A1D7DE7285DC78ADDE1B0A04E05DA44D0D46D4696F67A682D0D28313A53825FE
                                                                                                                                                                                                                          SHA-512:092DD7CEF6A5861472965E082171937EEDCFB3AE1821E3C88AA1BDFAB1EC48F765CAC497E3E5C78C19653C78B087C7CE28A8AB76F9073558963234901EF4B4A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Merida) {. {-9223372036854775808 -21508 0 LMT}. {-1514743200 -21600 0 CST}. {377935200 -18000 0 EST}. {407653200 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 CDT}. {1225004400 -21600 0 CST}. {1238918400 -18000 1 CD
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6462
                                                                                                                                                                                                                          Entropy (8bit):3.906655458013535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:XP19jJ+h5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:X99jIh5sBPy+CMt/ElALLVuAH
                                                                                                                                                                                                                          MD5:897140EE4C46A300FBA4B66692A77D2B
                                                                                                                                                                                                                          SHA1:D5F2F3C8561A19EA0C5DAF0236696D5DB98D4220
                                                                                                                                                                                                                          SHA-256:8B48C28A0AB6728CEDBCC82197355A5F9DD7D73E270EE949D996BB788777623B
                                                                                                                                                                                                                          SHA-512:17E52B3C00C4EDE3B2FA10A4BE0601889B12581D31936D075E85118F37329716C4083D2B16F7081F7AA73EC9774ED7B4CF67615BE6090F8A506BF77AADE0CAFD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Metlakatla) {. {-9223372036854775808 54822 0 LMT}. {-3225223727 -31578 0 LMT}. {-2188955622 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6807
                                                                                                                                                                                                                          Entropy (8bit):3.761365047166545
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:VeE7nN41+zKstuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sQ:VeE7nN41+zKstuNEsRZjWqZL/1dCYDDK
                                                                                                                                                                                                                          MD5:C675DA8A44A9841C417C585C2661EF13
                                                                                                                                                                                                                          SHA1:147DDE5DD00E520DA889AC9931088E6232CE6FEA
                                                                                                                                                                                                                          SHA-256:82B9AAD03408A9DFC0B6361EC923FEAEF97DBB4B3129B772B902B9DAE345D63E
                                                                                                                                                                                                                          SHA-512:00615A5EC0D08BABF009C3CAAF3D631B1F4E2E4324E91B0F29ADD7E61B51C80D5D495D20BD131A9370C3005B2E510C8A4E4869A5032D82BC33C875E909CDE086
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Mexico_City) {. {-9223372036854775808 -23796 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {-975261600 -18000 1 CDT}. {-963169200 -21600 0 CST}. {-917114400 -18000 1 CDT}. {-907354800 -21600 0 CST}. {-821901600 -18000 1 CWT}. {-810068400 -21600 0 CST}. {-627501600 -18000 1 CDT}. {-612990000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001836800 -21600 0 CST}. {1014184800 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6846
                                                                                                                                                                                                                          Entropy (8bit):3.44227328239419
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:FxfUaXYEn/wGm3eADKja4PcCYCJ7j7Ub0ZixJpF8pnmpRipo1kay2DfhJ+Nwz/ad:DeTntbDs
                                                                                                                                                                                                                          MD5:0C7122725D98CDE5CB9B22624D24A26C
                                                                                                                                                                                                                          SHA1:1889279EBE1377DB3460B706CAA4ECF803651517
                                                                                                                                                                                                                          SHA-256:86BB088047FB5A6041C7B0792D15F9CB453F49A54F78529CC415B7FF2C41265A
                                                                                                                                                                                                                          SHA-512:C23D3AE8D579FAC56521A0C06178550C4976E906A4CD149554821A2550B0EAB43344C6536166271EAA22EC77AF8529D9164696D7A5A740B02FA34C4272D43F26
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Miquelon) {. {-9223372036854775808 -13480 0 LMT}. {-1850328920 -14400 0 AST}. {326001600 -10800 0 -03}. {536468400 -10800 0 -02}. {544597200 -7200 1 -02}. {562132800 -10800 0 -02}. {576046800 -7200 1 -02}. {594187200 -10800 0 -02}. {607496400 -7200 1 -02}. {625636800 -10800 0 -02}. {638946000 -7200 1 -02}. {657086400 -10800 0 -02}. {671000400 -7200 1 -02}. {688536000 -10800 0 -02}. {702450000 -7200 1 -02}. {719985600 -10800 0 -02}. {733899600 -7200 1 -02}. {752040000 -10800 0 -02}. {765349200 -7200 1 -02}. {783489600 -10800 0 -02}. {796798800 -7200 1 -02}. {814939200 -10800 0 -02}. {828853200 -7200 1 -02}. {846388800 -10800 0 -02}. {860302800 -7200 1 -02}. {877838400 -10800 0 -02}. {891752400 -7200 1 -02}. {909288000 -10800 0 -02}. {923202000 -7200 1 -02}. {941342400 -10800 0 -02}. {954651600 -7200 1 -02}. {972792000 -10800 0 -
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10165
                                                                                                                                                                                                                          Entropy (8bit):3.73501024949866
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:XYtQYUKXZRMavqQS8L2En/RDmzTWRf2oFnoF8l988fL8vG+81VcfnrpbX+qvlrPf:gQYzCO4alKqYvuOdeYP/Jv
                                                                                                                                                                                                                          MD5:C1F34BD1FB4402481FFA5ABEE1573085
                                                                                                                                                                                                                          SHA1:46B9AD38086417554549C36A40487140256BED57
                                                                                                                                                                                                                          SHA-256:A4C2F586D7F59A192D6D326AD892C8BE20753FB4D315D506F4C2ED9E3F657B9A
                                                                                                                                                                                                                          SHA-512:115D3E65A6A3834E748ED1917CF03A835F74EC0F8DB789C2B99EB78879EA3A5A2AFEB35981BA221D868E6A5B579374CFB3F865ACF6D4271B918EBCC2C3C69579
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Moncton) {. {-9223372036854775808 -15548 0 LMT}. {-2715882052 -18000 0 EST}. {-2131642800 -14400 0 AST}. {-1632074400 -10800 1 ADT}. {-1615143600 -14400 0 AST}. {-1167595200 -14400 0 AST}. {-1153681200 -10800 1 ADT}. {-1145822400 -14400 0 AST}. {-1122231600 -10800 1 ADT}. {-1114372800 -14400 0 AST}. {-1090782000 -10800 1 ADT}. {-1082923200 -14400 0 AST}. {-1059332400 -10800 1 ADT}. {-1051473600 -14400 0 AST}. {-1027882800 -10800 1 ADT}. {-1020024000 -14400 0 AST}. {-996433200 -10800 1 ADT}. {-988574400 -14400 0 AST}. {-965674800 -10800 1 ADT}. {-955396800 -14400 0 AST}. {-934743600 -10800 1 ADT}. {-923947200 -14400 0 AST}. {-904503600 -10800 1 ADT}. {-891892800 -14400 0 AST}. {-883598400 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}. {-747252000 -10800 1 ADT}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6496
                                                                                                                                                                                                                          Entropy (8bit):3.75909042772931
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Xc+vN41+z6stuNEsRZjWqZL/1dCYDXEaXTuXMEXiH4RxGIJkYWXsWwav7jNf4sOt:saN41+z6stuNEsRZjWqZL/1dCYDDCxyI
                                                                                                                                                                                                                          MD5:255A5A8E27CA1F0127D71E09033C6D9B
                                                                                                                                                                                                                          SHA1:4F1C5E6D3F9E5BC9F8958FA50C195FDADD0F4022
                                                                                                                                                                                                                          SHA-256:C753DEF7056E26D882DCD842729816890D42B6C7E31522111467C0C39A24B2F2
                                                                                                                                                                                                                          SHA-512:96A67C3CC54EC39086D4DF681DDA39B4167FE80F0C45600045480F28C282071915F793BD672146119A22E0C15339F162DFF9DF326E7132E723684EF079666F58
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Monterrey) {. {-9223372036854775808 -24076 0 LMT}. {-1514743200 -21600 0 CST}. {568015200 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {599637600 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {891763200 -18000 1 CDT}. {909298800 -21600 0 CST}. {923212800 -18000 1 CDT}. {941353200 -21600 0 CST}. {954662400 -18000 1 CDT}. {972802800 -21600 0 CST}. {989136000 -18000 1 CDT}. {1001833200 -21600 0 CST}. {1018166400 -18000 1 CDT}. {1035702000 -21600 0 CST}. {1049616000 -18000 1 CDT}. {1067151600 -21600 0 CST}. {1081065600 -18000 1 CDT}. {1099206000 -21600 0 CST}. {1112515200 -18000 1 CDT}. {1130655600 -21600 0 CST}. {1143964800 -18000 1 CDT}. {1162105200 -21600 0 CST}. {1175414400 -18000 1 CDT}. {1193554800 -21600 0 CST}. {1207468800 -18000 1 C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2840
                                                                                                                                                                                                                          Entropy (8bit):3.549378422404712
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5JJjQSSSGEcS2SrPZSMSEkS/StSneSOSnx7EXnF9XXGGLgvA/Sa8h1liqZovoJqP:X9QV0cduTSe+J1ix7inFBXGGUvA/Sa8A
                                                                                                                                                                                                                          MD5:87A9F18CE5E5EE97D943316EE93DC664
                                                                                                                                                                                                                          SHA1:C221C82FA644943AF05C5737B4A68418BEFE66D7
                                                                                                                                                                                                                          SHA-256:E8DB201FDAF1FD43BE39422062CEB2A25F25764934C481A95CD7BB3F93949495
                                                                                                                                                                                                                          SHA-512:AC7D6BA85A37585BEC2101AAF0F46B04BF49F56B449A2BEC4E32D009576CA4D0CB687981EFA96DA8DAB00453F0020925E5FB9681BF8071AC6EFFC4F938E0D891
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Montevideo) {. {-9223372036854775808 -13491 0 LMT}. {-1942690509 -13491 0 MMT}. {-1567455309 -14400 0 -04}. {-1459627200 -10800 0 -0330}. {-1443819600 -12600 0 -0330}. {-1428006600 -10800 1 -0330}. {-1412283600 -12600 0 -0330}. {-1396470600 -10800 1 -0330}. {-1380747600 -12600 0 -0330}. {-1141590600 -10800 1 -0330}. {-1128286800 -12600 0 -0330}. {-1110141000 -10800 1 -0330}. {-1096837200 -12600 0 -0330}. {-1078691400 -10800 1 -0330}. {-1065387600 -12600 0 -0330}. {-1047241800 -10800 1 -0330}. {-1033938000 -12600 0 -0330}. {-1015187400 -10800 1 -0330}. {-1002488400 -12600 0 -0330}. {-983737800 -10800 1 -0330}. {-971038800 -12600 0 -0330}. {-954707400 -10800 1 -0330}. {-938984400 -12600 0 -0330}. {-920838600 -10800 1 -0330}. {-907534800 -12600 0 -0330}. {-896819400 -10800 1 -0330}. {-853621200 -9000 0 -03}. {-845847000 -10800 0 -03}. {-33
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.696915330047381
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI62IAcGEzQ21h4IAcGEqMKR:SlSWB9IZaM3y7RQ+VAIgpRQ+6290zQg2
                                                                                                                                                                                                                          MD5:F4631583229AD8B12C548E624AAF4A9F
                                                                                                                                                                                                                          SHA1:C56022CEACBD910C9CBF8C39C974021294AEE9DA
                                                                                                                                                                                                                          SHA-256:884575BE85D1276A1AE3426F33153B3D4787AC5238FDBE0991C6608E7EB0DF07
                                                                                                                                                                                                                          SHA-512:48FB9910D8A75AD9451C860716746D38B29319CA04DF9E8690D62FB875A5BEBCC7A8C546A60878821BD68A83271C69671D483C3133E4F807F2C3AC899CEBF065
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:America/Montreal) $TZData(:America/Toronto).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):205
                                                                                                                                                                                                                          Entropy (8bit):4.865859395466201
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290zQ1HK90e/:MBaIMY9QpI290zQ490O
                                                                                                                                                                                                                          MD5:705E51A8FB38AA8F9714256AFB55DA8A
                                                                                                                                                                                                                          SHA1:97D96BE4C08F128E739D541A43057F08D24DDDCF
                                                                                                                                                                                                                          SHA-256:0FED15D7D58E8A732110FF6765D0D148D15ACBB0251EE867CE7596933E999865
                                                                                                                                                                                                                          SHA-512:4D7E42ECDB16F7A8A62D9EDA1E365325F3CBFAA1EF0E9FEE2790E24BA8DEAAA716D41F9389B849C69DC3973DA61D575146932FB2C8AC81579C65C18E45AE386E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Montserrat) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8260
                                                                                                                                                                                                                          Entropy (8bit):3.7353311910027376
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JUzoaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Gzorn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:6F9F530A792FC34E2B0CEE4BC3DB3809
                                                                                                                                                                                                                          SHA1:4DF8A4A6993E47DD5A710BEE921D88FEF44858E7
                                                                                                                                                                                                                          SHA-256:9F62117DDA0A21D37B63C9083B3C50572399B22D640262F427D68123078B32F9
                                                                                                                                                                                                                          SHA-512:C2BF93FDBE8430113FA63561D1A08145DCF31CD679AB7230098993C7A19EF0F29F486C962656F8A62505CB1BFE993FBD3BB5FB0BAE7B6E7E190DE2865C445408
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nassau) {. {-9223372036854775808 -18570 0 LMT}. {-1825095030 -18000 0 EST}. {-179341200 -14400 1 EDT}. {-163620000 -18000 0 EST}. {-147891600 -14400 1 EDT}. {-131565600 -18000 0 EST}. {-116442000 -14400 1 EDT}. {-100116000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {189320400 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11004
                                                                                                                                                                                                                          Entropy (8bit):3.725417189649631
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:iNXYUiZrbgZ8UMr5UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:23iZrbgZ8UMr2wdrn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:C9D78AB6CF796A9D504BE2903F00B49C
                                                                                                                                                                                                                          SHA1:A6C0E4135986A1A6F36B62276BFAB396DA1A4A9B
                                                                                                                                                                                                                          SHA-256:1AB6E47D96BC34F57D56B936233F58B5C748B65E06AFF6449C3E3C317E411EFE
                                                                                                                                                                                                                          SHA-512:6D20B13F337734CB58198396477B7C0E9CB89ED4D7AB328C22A4A528CAF187D10F42540DBB4514A0C139E6F4AE9A1A71AED02E3735D1D4F12C5314014C0C1EB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/New_York) {. {-9223372036854775808 -17762 0 LMT}. {-2717650800 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-1577905200 -18000 0 EST}. {-1570381200 -14400 1 EDT}. {-1551636000 -18000 0 EST}. {-1536512400 -14400 1 EDT}. {-1523210400 -18000 0 EST}. {-1504458000 -14400 1 EDT}. {-1491760800 -18000 0 EST}. {-1473008400 -14400 1 EDT}. {-1459706400 -18000 0 EST}. {-1441558800 -14400 1 EDT}. {-1428256800 -18000 0 EST}. {-1410109200 -14400 1 EDT}. {-1396807200 -18000 0 EST}. {-1378659600 -14400 1 EDT}. {-1365357600 -18000 0 EST}. {-1347210000 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-122080680
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7836
                                                                                                                                                                                                                          Entropy (8bit):3.7462966187089535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:rEa2raC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:rYrrn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:3D389AA51D3E29E8A1E8ED07646AA0DD
                                                                                                                                                                                                                          SHA1:2E3DF9406B14662ADEDDC0F891CD81DF23D98157
                                                                                                                                                                                                                          SHA-256:3A0FB897E5CCB31B139E009B909053DCE36BB5791ACF23529D874AFA9F0BB405
                                                                                                                                                                                                                          SHA-512:AFF7B30355ECB6EBD43D1E6C943C250AB98CC82BDC8DDC7595769E4CE188A23591AEFCF18A028CC6479CF6AA20F65980E37C74F6CEE907537366136FAF29B66E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nipigon) {. {-9223372036854775808 -21184 0 LMT}. {-2366734016 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-923252400 -14400 1 EDT}. {-880218000 -14400 0 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600 -18000 0 EST}. {388566000 -14400 1 EDT}. {404892000 -18000 0 EST}. {420015600 -14400 1 EDT}. {436341600 -18000 0 EST}. {452070000 -14400 1 EDT}. {467791200 -18000 0 EST}. {483519600 -14400 1 EDT}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8404
                                                                                                                                                                                                                          Entropy (8bit):3.88589736733708
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OWmWQm825s/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:OWmWQmI/4h5sBPy+CMt/ElALLVuAH
                                                                                                                                                                                                                          MD5:F5E89780553D3D30A32CF65746CA9A69
                                                                                                                                                                                                                          SHA1:43D8B6E3C5D719599A680E1E6D4FF913D2700D7E
                                                                                                                                                                                                                          SHA-256:5BDA4867EC7707E9D5E07AD3E558DA7C1E44EC1135E85A8F1809441A54B22BE5
                                                                                                                                                                                                                          SHA-512:D1239FF5277055DD8787BF58ED14DBDC229FC46EDDF21E034CA77DEA439631974F44FCE63EF12483520ADB83AD235642AE480230544A7284A8BDAA5296486563
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Nome) {. {-9223372036854775808 46702 0 LMT}. {-3225223727 -39698 0 LMT}. {-2188947502 -39600 0 NST}. {-883573200 -39600 0 NST}. {-880196400 -36000 1 NWT}. {-769395600 -36000 1 NPT}. {-765374400 -39600 0 NST}. {-757342800 -39600 0 NST}. {-86878800 -39600 0 BST}. {-31496400 -39600 0 BST}. {-21466800 -36000 1 BDT}. {-5745600 -39600 0 BST}. {9982800 -36000 1 BDT}. {25704000 -39600 0 BST}. {41432400 -36000 1 BDT}. {57758400 -39600 0 BST}. {73486800 -36000 1 BDT}. {89208000 -39600 0 BST}. {104936400 -36000 1 BDT}. {120657600 -39600 0 BST}. {126709200 -36000 1 BDT}. {152107200 -39600 0 BST}. {162392400 -36000 1 BDT}. {183556800 -39600 0 BST}. {199285200 -36000 1 BDT}. {215611200 -39600 0 BST}. {230734800 -36000 1 BDT}. {247060800 -39600 0 BST}. {262789200 -36000 1 BDT}. {278510400 -39600 0 BST}. {294238800 -36000 1 BDT}. {309960000 -3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1349
                                                                                                                                                                                                                          Entropy (8bit):3.6915980783248976
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ8eHNxrW3YrEnBrur9rTPBrJ2r+KrDv1rn1rHhr33rPxN4brSJrrh4rEgtXrH1W:5PxrW3YrEnBruxrT5rJ2r+KrDv1rn1r/
                                                                                                                                                                                                                          MD5:10B0C457561BA600E9A39CE20CD22B72
                                                                                                                                                                                                                          SHA1:07946FBB04D0C8D7CA92204E3E2DF3AB755196AB
                                                                                                                                                                                                                          SHA-256:96AEE3A529C11C8DBDE3431C65C8C2315DBCFB5686957419EFCEB3D49208AB11
                                                                                                                                                                                                                          SHA-512:A60AFB3DD064EAB9C4AE5F0A112DA5A7903BDB99DCF78BB99FE13DBB72310E8D47A2A62A58DAD2AB4F33971001F5B9787D663649E05FBD47B75994113CD5E8ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Noronha) {. {-9223372036854775808 -7780 0 LMT}. {-1767217820 -7200 0 -02}. {-1206961200 -3600 1 -02}. {-1191366000 -7200 0 -02}. {-1175378400 -3600 1 -02}. {-1159830000 -7200 0 -02}. {-633823200 -3600 1 -02}. {-622072800 -7200 0 -02}. {-602287200 -3600 1 -02}. {-591836400 -7200 0 -02}. {-570751200 -3600 1 -02}. {-560214000 -7200 0 -02}. {-539128800 -3600 1 -02}. {-531356400 -7200 0 -02}. {-191368800 -3600 1 -02}. {-184201200 -7200 0 -02}. {-155167200 -3600 1 -02}. {-150073200 -7200 0 -02}. {-128901600 -3600 1 -02}. {-121129200 -7200 0 -02}. {-99957600 -3600 1 -02}. {-89593200 -7200 0 -02}. {-68421600 -3600 1 -02}. {-57970800 -7200 0 -02}. {499744800 -3600 1 -02}. {511232400 -7200 0 -02}. {530589600 -3600 1 -02}. {540262800 -7200 0 -02}. {562125600 -3600 1 -02}. {571194000 -7200 0 -02}. {592970400 -3600 1 -02}. {602038800 -7200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8278
                                                                                                                                                                                                                          Entropy (8bit):3.7975723806562063
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:raF2dVtXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Dac5TE35:OFcVtXwDTIRqfh57Tlto//q7u379zlqw
                                                                                                                                                                                                                          MD5:15AABAE9ABE4AF7ABEADF24A510E9583
                                                                                                                                                                                                                          SHA1:3DEF11310D02F0492DF09591A039F46A8A72D086
                                                                                                                                                                                                                          SHA-256:B328CC893D217C4FB6C84AA998009940BFBAE240F944F40E7EB900DEF1C7A5CF
                                                                                                                                                                                                                          SHA-512:7A12A25EB6D6202C47CFDD9F3CE71342406F0EDA3D1D68B842BCFE97EFF1F2E0C11AD34D4EE0A61DF7E0C7E8F400C8CCA73230BDB3C677F8D15CE5CBA44775D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Beulah) {. {-9223372036854775808 -24427 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8278
                                                                                                                                                                                                                          Entropy (8bit):3.7834920003907664
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:LF2dK7X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaT:LFcK7X0N41+IestuNEbYkzbXwDTIRqfK
                                                                                                                                                                                                                          MD5:AC804124F4CE4626F5C1FDA2BC043011
                                                                                                                                                                                                                          SHA1:4B3E8CC90671BA543112CEE1AB5450C6EA4615DF
                                                                                                                                                                                                                          SHA-256:E90121F7D275FDCC7B8DCDEC5F8311194D432510FEF5F5F0D6F211A4AACB78EF
                                                                                                                                                                                                                          SHA-512:056EF65693C16CB58EC5A223528C636346DB37B75000397D03663925545979792BBC50B20B5AA20139ECE9A9D6B73DA80C2319AA4F0609D6FC1A6D30D0567C58
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/Center) {. {-9223372036854775808 -24312 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MS
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8281
                                                                                                                                                                                                                          Entropy (8bit):3.795939700557522
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:uF2dyuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u379zlq3LtVBaANIsrXHEK5Da:uFcyuNEbYkzbXwDTIRqfh57Tlto//q7k
                                                                                                                                                                                                                          MD5:E26FC508DFD73B610C5543487C763FF5
                                                                                                                                                                                                                          SHA1:8FBDE67AF561037AAA2EDF93E9456C7E534F4B5A
                                                                                                                                                                                                                          SHA-256:387D3C57EDE8CCAAD0655F19B35BC0D124C016D16F06B6F2498C1151E4792778
                                                                                                                                                                                                                          SHA-512:8A10B7370D1521EDF18AB4D5192C930ABC68AB9AE718ADF3D175EACE9A1F5DAC690A76B02EFB4059374761962D8C2660497F8E951DFE9812FB3CFCFDF9165E45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/North_Dakota/New_Salem) {. {-9223372036854775808 -24339 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6621
                                                                                                                                                                                                                          Entropy (8bit):3.7945318113967823
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5gUFM/6M/Mp5tyTc8Ln4ypZ9giGuWGwZIoktiz+hL5Cw5feQ5BT5rBSNNOVQoh/5:KJNfzo+C2mWBNQMsmNTxf6AeO+cblX
                                                                                                                                                                                                                          MD5:D88A28F381C79410D816F8D2D1610A02
                                                                                                                                                                                                                          SHA1:81949A1CACD5907CA5A8649385C03813EEFCDDE0
                                                                                                                                                                                                                          SHA-256:F65C0F8532387AFE703FACDEE325BF8D7F3D1232DEE92D65426FF917DD582CB3
                                                                                                                                                                                                                          SHA-512:9A9B0C65ECDFF690EF2933B323B3A1CF2D67D0A43F285BB9FEEFF275316148A07F5AC044C48F64E3D8CFA7C1DE44AF220A6855DC01225F8BFFF63AEC946B944A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Ojinaga) {. {-9223372036854775808 -25060 0 LMT}. {-1514739600 -25200 0 MST}. {-1343066400 -21600 0 CST}. {-1234807200 -25200 0 MST}. {-1220292000 -21600 0 CST}. {-1207159200 -25200 0 MST}. {-1191344400 -21600 0 CST}. {820476000 -21600 0 CST}. {828864000 -18000 1 CDT}. {846399600 -21600 0 CST}. {860313600 -18000 1 CDT}. {877849200 -21600 0 CST}. {883634400 -21600 0 CST}. {891766800 -21600 0 MDT}. {909302400 -25200 0 MST}. {923216400 -21600 1 MDT}. {941356800 -25200 0 MST}. {954666000 -21600 1 MDT}. {972806400 -25200 0 MST}. {989139600 -21600 1 MDT}. {1001836800 -25200 0 MST}. {1018170000 -21600 1 MDT}. {1035705600 -25200 0 MST}. {1049619600 -21600 1 MDT}. {1067155200 -25200 0 MST}. {1081069200 -21600 1 MDT}. {1099209600 -25200 0 MST}. {1112518800 -21600 1 MDT}. {1130659200 -25200 0 MST}. {1143968400 -21600 1 MDT}. {1162108800 -2520
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.924365872261203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52IAcGEu5fcXGm2OHGf8xYvX5BidhZSsc1HRX1vain:SlSWB9X5290WTm2OHDxYP5GhZE3X1iin
                                                                                                                                                                                                                          MD5:771816CABF25492752C5DA76C5EF74A5
                                                                                                                                                                                                                          SHA1:6494F467187F99C9A51AB670CD8DC35078D63904
                                                                                                                                                                                                                          SHA-256:0E323D15EA84D4B6E838D5DCD99AEE68666AF97A770DA2AF84B7BDCA4AB1DBBA
                                                                                                                                                                                                                          SHA-512:C32D918E121D800B9DFD5CE1F13A4BF2505C0EDCE0085639C8EDF48073E0888906F1A28EF375BDCF549DB14CD33F7C405E28BC35DDF22445C224FBC64146B4EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Panama) {. {-9223372036854775808 -19088 0 LMT}. {-2524502512 -19176 0 CMT}. {-1946918424 -18000 0 EST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7484
                                                                                                                                                                                                                          Entropy (8bit):3.768929501362495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:i2KFEUlpde9pXbO53or0gqvOTFhPI1jFIL:n0r3+
                                                                                                                                                                                                                          MD5:2701DA468F9F1C819301374E807AAA27
                                                                                                                                                                                                                          SHA1:F08D7525639EA752D52F36A6D14F14C5514CED8E
                                                                                                                                                                                                                          SHA-256:6C7DFDE581AC9DE7B4ED6A525A40F905B7550BD2AE7E55D7E2E1B81B771D030B
                                                                                                                                                                                                                          SHA-512:98BD9EDD40D2982E20A169B8B8E8D411382E5707634BB4F8365CFFF73DB17B8C042D7ED1A59B9511A3A7EB587895119532CCED69F5EFBC49D74FFDC9CA91966F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Pangnirtung) {. {-9223372036854775808 0 0 -00}. {-1546300800 -14400 0 AST}. {-880221600 -10800 1 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-147902400 -7200 1 ADDT}. {-131572800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050400 -10800 1 ADT}. {594190800 -14400 0 AST}. {607500000 -10800 1 ADT}. {625640400 -14400 0 AST}. {638949600 -10800 1 ADT}. {657090000 -14400 0 AST}. {671004000 -10800 1 ADT}. {688539600 -14400 0 AST}. {702
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):244
                                                                                                                                                                                                                          Entropy (8bit):4.731092370398455
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290oldJm2OHeke3FIMVTvVOzGXg/VVFAHC:MBp5290olLmdHeV3qSv4zX/OHC
                                                                                                                                                                                                                          MD5:5D11C2A86B0CDE60801190BFC8FA5E0B
                                                                                                                                                                                                                          SHA1:38A63200995E359E61F1DEA00C5716938ED7A499
                                                                                                                                                                                                                          SHA-256:D2078D8D396D5189E1D3555628960990FD63694D08256FF814EE841E01A3F56E
                                                                                                                                                                                                                          SHA-512:D4D83019E5AE05C3FCDE3518672DC08925C0DECC9FCA6927D75ADA969647CE8EF2D1C67FFD1A075969309CD1B1AADDF15DB21ABDAF241EAA450D2C9E038AEF6A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Paramaribo) {. {-9223372036854775808 -13240 0 LMT}. {-1861906760 -13252 0 PMT}. {-1104524348 -13236 0 PMT}. {-765317964 -12600 0 -0330}. {465449400 -10800 0 -03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):479
                                                                                                                                                                                                                          Entropy (8bit):4.379302206927978
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290OQmdH514YPFotFg4tFQxRgmjtFdRb2:cQCeksFsFgcFQxBhF7b2
                                                                                                                                                                                                                          MD5:1B5C5CBC4168FCCC9100487D3145AF6D
                                                                                                                                                                                                                          SHA1:6E9E3074B783108032469C8E601D2C63A573B840
                                                                                                                                                                                                                          SHA-256:9E28F87C0D9EE6AD6791A220742C10C135448965E1F66A7EB04D6477D8FA11B0
                                                                                                                                                                                                                          SHA-512:4A6527FF5C7F0A0FDC574629714399D9A475EDC1338BF4C9EEEEDCC8CA23E14D2DE4DCA421D46FABA813A65236CD7B8ADBE103B641A763C6BC508738BF73A58C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Phoenix) {. {-9223372036854775808 -26898 0 LMT}. {-2717643600 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-820519140 -25200 0 MST}. {-796841940 -25200 0 MST}. {-94669200 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-56221200 -25200 0 MST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6398
                                                                                                                                                                                                                          Entropy (8bit):3.770736282266079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5IV1C8phBVSWroLMEbF8xzqXtWl5Hm0RU+5oaIOWIF4IPWFeB/5udPOcBqYZ4vxl:mKXrvOTFhP5S+ijFnRaJeaX1eyDt
                                                                                                                                                                                                                          MD5:7802A7D0CAEECF52062EA9AAC665051A
                                                                                                                                                                                                                          SHA1:D965CD157A99FD258331A45F5E86B8F17A444D2B
                                                                                                                                                                                                                          SHA-256:3D1BEDC932E5CB6315438C7EF060824C927C547009EEA25E8CF16C9D8C4A28B6
                                                                                                                                                                                                                          SHA-512:4D369FF44CC1B1CBA75C0249B032581BA792830479D22C418C5B0599975E715B8983D93F52B00793F2A419F530BC8877D2DA251393592FD6B865499A97875FD8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port-au-Prince) {. {-9223372036854775808 -17360 0 LMT}. {-2524504240 -17340 0 PPMT}. {-1670483460 -18000 0 EST}. {421218000 -14400 1 EDT}. {436334400 -18000 0 EST}. {452062800 -14400 1 EDT}. {467784000 -18000 0 EST}. {483512400 -14400 1 EDT}. {499233600 -18000 0 EST}. {514962000 -14400 1 EDT}. {530683200 -18000 0 EST}. {546411600 -14400 1 EDT}. {562132800 -18000 0 EST}. {576050400 -14400 1 EDT}. {594194400 -18000 0 EST}. {607500000 -14400 1 EDT}. {625644000 -18000 0 EST}. {638949600 -14400 1 EDT}. {657093600 -18000 0 EST}. {671004000 -14400 1 EDT}. {688543200 -18000 0 EST}. {702453600 -14400 1 EDT}. {719992800 -18000 0 EST}. {733903200 -14400 1 EDT}. {752047200 -18000 0 EST}. {765352800 -14400 1 EDT}. {783496800 -18000 0 EST}. {796802400 -14400 1 EDT}. {814946400 -18000 0 EST}. {828856800 -14400 1 EDT}. {846396000 -18000 0 EST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):155
                                                                                                                                                                                                                          Entropy (8bit):5.077805073731929
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52IAcGEuPXGkXGm2OHUnvUdxKzVvwvYv:SlSWB9X5290eSm2OHkzVr
                                                                                                                                                                                                                          MD5:8169D55899164E2168EF50E219115727
                                                                                                                                                                                                                          SHA1:42848A510C120D4E834BE61FC76A1C539BA88C8A
                                                                                                                                                                                                                          SHA-256:6C8718C65F99AB43377609705E773C93F7993FBB3B425E1989E8231308C475AF
                                                                                                                                                                                                                          SHA-512:1590D42E88DD92542CADC022391C286842C156DA4795877EA67FEF045E0A831615C3935E08098DD71CF29C972EDC79084FFCC9AFAB7813AE74EEE14D6CFEFB9D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Port_of_Spain) {. {-9223372036854775808 -14764 0 LMT}. {-1825098836 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):196
                                                                                                                                                                                                                          Entropy (8bit):4.818272118524638
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7thtedVAIgpthKQ290msh490thB:MBaIMYdxpR290v490x
                                                                                                                                                                                                                          MD5:1C0C736D0593654230FCBB0DC275313B
                                                                                                                                                                                                                          SHA1:00518615F97BCFF2F6862116F4DF834B70E2D4CA
                                                                                                                                                                                                                          SHA-256:5C97E6DF0FC03F13A0814274A9C3A983C474000AE3E78806B38DF9208372FD54
                                                                                                                                                                                                                          SHA-512:2252D17CB4F770124586BBF35974077212B92C1587071C9F552F1EFAC15CBF92128E61C456F9F5154D212F7D66CC5BD85B76B1187D5A6F24E89E14EDF322D67F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:America/Porto_Acre) $TZData(:America/Rio_Branco).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1016
                                                                                                                                                                                                                          Entropy (8bit):3.7660008200834842
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQQe478Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSj/f:5bSaSwXS4SqSbS3JSySxSxcSESAlSQSv
                                                                                                                                                                                                                          MD5:5E4CB713378D22D90A1A86F0AF33D6E8
                                                                                                                                                                                                                          SHA1:CF4B2A68873BF778257D40AEA887D4BCBEE6CC72
                                                                                                                                                                                                                          SHA-256:6D7F49E0A67C69A3945DA4BC780653C8D875650536A810610A6518080CC483DB
                                                                                                                                                                                                                          SHA-512:06559B6E80BCDD42120398E19CCB3AEE8A1B08E09D0DF07DB9CCD68A863A7670D6D6457018CE3D9E23FE359D3E2EC0D249134EE0D969C0312665975B67DB8E80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Porto_Velho) {. {-9223372036854775808 -15336 0 LMT}. {-1767210264 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):273
                                                                                                                                                                                                                          Entropy (8bit):4.728240676465187
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290pbm2OH9VPMGoeVVFrZVVFUFkeF3k/eJpR/r:MBp5290lmdHvPMpe/ZZ/uFkeF3k/eJ/D
                                                                                                                                                                                                                          MD5:2FB893819124F19A7068F802D6A59357
                                                                                                                                                                                                                          SHA1:6B35C198F74FF5880714A3182407858193CE37A4
                                                                                                                                                                                                                          SHA-256:F05530CFBCE7242847BE265C2D26C8B95B00D927817B050A523FFB139991B09E
                                                                                                                                                                                                                          SHA-512:80739F431F6B3548EFD4F70FE3630F66F70CB29B66845B8072D26393ADD7DAB22675BE6DA5FBDC7561D4F3F214816AAD778B6CD0EE45264B4D6FFA48B3AC7C43
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Puerto_Rico) {. {-9223372036854775808 -15865 0 LMT}. {-2233035335 -14400 0 AST}. {-873057600 -10800 0 AWT}. {-769395600 -10800 1 APT}. {-765399600 -14400 0 AST}. {-757368000 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3576
                                                                                                                                                                                                                          Entropy (8bit):3.5316229197228632
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:Yv9+P8pYraRo+kP0pDrMb6UHlRnHqhTxxJAHXEa9c0yq/g2tw5E8fIk5iWpOFZAd:YoP8pYraRo+kP0pDrMb60RnHqhTxxJAw
                                                                                                                                                                                                                          MD5:1FFFED9AA83AA3CA9E7330AA27E8D188
                                                                                                                                                                                                                          SHA1:9B45F2662C1F3F0799ED4221E843483674878F43
                                                                                                                                                                                                                          SHA-256:FECDC08709D5852A07D8F5C7DD7DBDBCD3D864A0893248E3D3932A2F848EB4B2
                                                                                                                                                                                                                          SHA-512:8F6D51F94A91168EE092972316E150C2B487808EA3506F77FD028F84436FE29AD5BAD50A8DB65BCFB524D5A12DC1C66C5C0BC9A7FC6AE8A0EAAED6F4BA5ADED7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Punta_Arenas) {. {-9223372036854775808 -17020 0 LMT}. {-2524504580 -16966 0 SMT}. {-1892661434 -18000 0 -05}. {-1688410800 -16966 0 SMT}. {-1619205434 -14400 0 -04}. {-1593806400 -16966 0 SMT}. {-1335986234 -18000 0 -05}. {-1335985200 -14400 1 -05}. {-1317585600 -18000 0 -05}. {-1304362800 -14400 1 -05}. {-1286049600 -18000 0 -05}. {-1272826800 -14400 1 -05}. {-1254513600 -18000 0 -05}. {-1241290800 -14400 1 -05}. {-1222977600 -18000 0 -05}. {-1209754800 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1178132400 -14400 0 -04}. {-870552000 -18000 0 -05}. {-865278000 -14400 0 -04}. {-718056000 -18000 0 -05}. {-713649600 -14400 0 -04}. {-36619200 -10800 1 -04}. {-23922000 -14400 0 -04}. {-3355200 -10800 1 -04}. {7527600 -14400 0 -04}. {24465600 -10800 1 -04}. {37767600 -14400 0 -04}. {55915200 -10800 1 -04}. {69217200 -14400 0 -04}. {87
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7840
                                                                                                                                                                                                                          Entropy (8bit):3.75014960690837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:k+iBktTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbdXvDXpVS:k+iBmTzZSJw5/9/yuvQ6crD57X0N41+a
                                                                                                                                                                                                                          MD5:9C10496730E961187C33C1AE91C8A60D
                                                                                                                                                                                                                          SHA1:A77E3508859FB6F76A7445CD13CD42348CB4EBC7
                                                                                                                                                                                                                          SHA-256:136F0A49742F30B05B7C6BF3BF014CC999104F4957715D0BEB39F5440D5216DF
                                                                                                                                                                                                                          SHA-512:70936E65D0B439F6BE6E31E27032F10BA2EB54672647DA615744ABC7A767F197F0C7FDBCCEE0D335CBCECB6855B7BD899D1A5B97BA5083FFA42AF5F30343EA7F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rainy_River) {. {-9223372036854775808 -22696 0 LMT}. {-2366732504 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-923248800 -18000 1 CDT}. {-880214400 -18000 0 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {136368000 -18000 1 CDT}. {152089200 -21600 0 CST}. {167817600 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -21600 0 CST}. {294220800 -18000 1 CDT}. {309942000 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7366
                                                                                                                                                                                                                          Entropy (8bit):3.749928775816306
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:vw5/9/yuvQ+hcrD57X0N41+IstuNEbYkzbXwDTIRqfhXbdXvDXpVXVto//q7u37N:vw5/9/yuvQ6crD57X0N41+IstuNEbYkJ
                                                                                                                                                                                                                          MD5:54F6D5098A0CF940F066EADEEA234A57
                                                                                                                                                                                                                          SHA1:20B9FE5F6F70E97420A6D9939AA43C4CCFA8231B
                                                                                                                                                                                                                          SHA-256:AA68088E41A018002E5CE12B14F8910E5ECE5F26D5854092E351BAAC2F90DB2B
                                                                                                                                                                                                                          SHA-512:9EC1AF599604CEE266D9A4377B6CDABF94E61D0177CBC2158122406BF551AE0E3EE4CF147B28A382277B015CCB8F4405DB3EB3AE6425431EBB43CCDE08AEA3E1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rankin_Inlet) {. {-9223372036854775808 0 0 -00}. {-410227200 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {75205
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1372
                                                                                                                                                                                                                          Entropy (8bit):3.6943875149362064
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQHJeHQc4h1u80V2dBUGphmC17ewGtN3rvIh0VBHZDIykqWoN:5Kh4h19U2dBUGrmO7XGtN3kh0VBHZUnk
                                                                                                                                                                                                                          MD5:1567A3F3419D1A4FCF817A6EDC11769E
                                                                                                                                                                                                                          SHA1:2970F9EDD76B77A843D31F518587C17A05EC4C43
                                                                                                                                                                                                                          SHA-256:3F62246DF3A378815772D9D942033FB235B048B62F5EF52A3DCD6DB3871E0DB5
                                                                                                                                                                                                                          SHA-512:567BEAC48AE0FEEB32FE40EEA73EB4601DBDBF72FA963777E5F5C3E9972E2AD7A359301E80E574592AFB3045414A177D0ABD38DF958BD5317B02D4DFD2DCE607
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Recife) {. {-9223372036854775808 -8376 0 LMT}. {-1767217224 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-191365200 -7200 1 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}. {592974000 -7200 1 -03}. {60
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1723
                                                                                                                                                                                                                          Entropy (8bit):3.956012642028802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:56ecDOBDgE+hIZVEa3lGw+6yZgTX+rNO46wYDW:86VlGS8
                                                                                                                                                                                                                          MD5:7D955B277C43D51F19377A91B987FAF9
                                                                                                                                                                                                                          SHA1:F2F3E11E955C3E58E21654F3D841B5B1528C0913
                                                                                                                                                                                                                          SHA-256:A1FA7BF002B3BA8DCA4D52AA0BB41C047DDAF88B2E542E1FCF81CB3AAF91AA75
                                                                                                                                                                                                                          SHA-512:719DEE7A932EDB9255D711E82AC0CA3FCFB07AF3EFE2EE0D887D7137F6059BEBE07F85D910CC0005391D244B4EADA16257BE49787938386FD4B5DB6D8E31D513
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Regina) {. {-9223372036854775808 -25116 0 LMT}. {-2030202084 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1251651600 -21600 1 MDT}. {-1238349600 -25200 0 MST}. {-1220202000 -21600 1 MDT}. {-1206900000 -25200 0 MST}. {-1188752400 -21600 1 MDT}. {-1175450400 -25200 0 MST}. {-1156698000 -21600 1 MDT}. {-1144000800 -25200 0 MST}. {-1125248400 -21600 1 MDT}. {-1111946400 -25200 0 MST}. {-1032714000 -21600 1 MDT}. {-1016992800 -25200 0 MST}. {-1001264400 -21600 1 MDT}. {-986148000 -25200 0 MST}. {-969814800 -21600 1 MDT}. {-954093600 -25200 0 MST}. {-937760400 -21600 1 MDT}. {-922039200 -25200 0 MST}. {-906310800 -21600 1 MDT}. {-890589600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-748450800 -21600 1 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7362
                                                                                                                                                                                                                          Entropy (8bit):3.7460671071064846
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:iw5/9/yuvQ+hcrD57X0N41+IstuNESkzbXwDTIRqfhXbdXvDXpVXVto//q7u379L:iw5/9/yuvQ6crD57X0N41+IstuNESkzV
                                                                                                                                                                                                                          MD5:07FFF43B350D520D13D91701618AD72E
                                                                                                                                                                                                                          SHA1:8D4B36A6D3257509C209D0B78B58982709FB8807
                                                                                                                                                                                                                          SHA-256:39E13235F87A1B8621ADA62C9AD2EBF8E17687C5533658E075EFA70A04D5C78D
                                                                                                                                                                                                                          SHA-512:37397A2621F0A1EA6B46F6769D583CAEA9703924A2C652B8B58FA4C7DBA8E789BA8FE442FB2C77504E495617591FB138AD733063E3A4A0153ED2B26D4B863018
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Resolute) {. {-9223372036854775808 0 0 -00}. {-704937600 -21600 0 CST}. {-147895200 -14400 1 CDDT}. {-131565600 -21600 0 CST}. {325670400 -18000 1 CDT}. {341391600 -21600 0 CST}. {357120000 -18000 1 CDT}. {372841200 -21600 0 CST}. {388569600 -18000 1 CDT}. {404895600 -21600 0 CST}. {420019200 -18000 1 CDT}. {436345200 -21600 0 CST}. {452073600 -18000 1 CDT}. {467794800 -21600 0 CST}. {483523200 -18000 1 CDT}. {499244400 -21600 0 CST}. {514972800 -18000 1 CDT}. {530694000 -21600 0 CST}. {544608000 -18000 1 CDT}. {562143600 -21600 0 CST}. {576057600 -18000 1 CDT}. {594198000 -21600 0 CST}. {607507200 -18000 1 CDT}. {625647600 -21600 0 CST}. {638956800 -18000 1 CDT}. {657097200 -21600 0 CST}. {671011200 -18000 1 CDT}. {688546800 -21600 0 CST}. {702460800 -18000 1 CDT}. {719996400 -21600 0 CST}. {733910400 -18000 1 CDT}. {752050800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1075
                                                                                                                                                                                                                          Entropy (8bit):3.7557219407321303
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQYEeH5yyss/u/C5/ukCI/uiCk/u8CHe/uOCXs/um4Co/uN3Cc/ux8CL/uiFCy/i:5q5xs5IlTToo4mdGFtapG8dtedkFL
                                                                                                                                                                                                                          MD5:9AA66AEB91380EFD3313338A2DCBE432
                                                                                                                                                                                                                          SHA1:2D86915D1F331CC7050BBFAAE3315CE1440813C1
                                                                                                                                                                                                                          SHA-256:53DB45CF4CB369DA06C31478A793E787541DA0E77C042EBC7A10175A6BB6EFF6
                                                                                                                                                                                                                          SHA-512:C9B4F6544B4A1E77BFF6D423A9AD5E003E32FA77B00ECC2A7AF6D2279ACC849ABE331E5DE27C450A6BF86ECC2450CEBFAB4880AB69C54649D4C7EE0AF05CD377
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Rio_Branco) {. {-9223372036854775808 -16272 0 LMT}. {-1767209328 -18000 0 -05}. {-1206950400 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1175367600 -14400 1 -05}. {-1159819200 -18000 0 -05}. {-633812400 -14400 1 -05}. {-622062000 -18000 0 -05}. {-602276400 -14400 1 -05}. {-591825600 -18000 0 -05}. {-570740400 -14400 1 -05}. {-560203200 -18000 0 -05}. {-539118000 -14400 1 -05}. {-531345600 -18000 0 -05}. {-191358000 -14400 1 -05}. {-184190400 -18000 0 -05}. {-155156400 -14400 1 -05}. {-150062400 -18000 0 -05}. {-128890800 -14400 1 -05}. {-121118400 -18000 0 -05}. {-99946800 -14400 1 -05}. {-89582400 -18000 0 -05}. {-68410800 -14400 1 -05}. {-57960000 -18000 0 -05}. {499755600 -14400 1 -05}. {511243200 -18000 0 -05}. {530600400 -14400 1 -05}. {540273600 -18000 0 -05}. {562136400 -14400 1 -05}. {571204800 -18000 0 -05}. {590040000 -
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):214
                                                                                                                                                                                                                          Entropy (8bit):4.752946571641783
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7/MdVAIgp/MOF290rI5290/Msn:MBaIMY/M4p/MOF290r190/Ms
                                                                                                                                                                                                                          MD5:4FC460A084DF33A73F2F87B7962B0084
                                                                                                                                                                                                                          SHA1:45E70D5D68FC2DE0ACFF76B062ADA17E0021460F
                                                                                                                                                                                                                          SHA-256:D1F5FFD2574A009474230E0AA764256B039B1D78D91A1CB944B21776377B5B70
                                                                                                                                                                                                                          SHA-512:40045420FE88FA54DE4A656534C0A51357FBAB3EA3B9120DA15526A9DEC7EEC2C9799F4D9A72B6050474AD67490BC28540FDA0F17B7FCAF125D41CBCA96ECCDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Argentina/Cordoba)]} {. LoadTimeZoneFile America/Argentina/Cordoba.}.set TZData(:America/Rosario) $TZData(:America/Argentina/Cordoba).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):4.820569634622523
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo2IAcGEtX2exp4IAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo290tX2U49Q
                                                                                                                                                                                                                          MD5:75EA3845AFED3FBBF8496824A353DA32
                                                                                                                                                                                                                          SHA1:207A1520F041B09CCD5034E6E87D3F7A4FBD460E
                                                                                                                                                                                                                          SHA-256:2FACC167377FC1F592D2926829EB2980F58BE38D50424F64DFA04A2ECBBE1559
                                                                                                                                                                                                                          SHA-512:B9D4DB95CEA1DADCE27264BBD198676465854E9C55D6BB175966D860D9AF7014F6635A945510602C0A9FBF08596B064DAE7D30589886960F06B2F8E69786CFF6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:America/Santa_Isabel) $TZData(:America/Tijuana).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1043
                                                                                                                                                                                                                          Entropy (8bit):3.7336343389566795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQceUh8Sos/USws/QSI/LHSD/vOSy/WS3o/aS2/vSh/TSSX/WcSp/ySZd/YlSj/X:57SaSwXS4SqSbS3JSySxSxcSESAlSQSn
                                                                                                                                                                                                                          MD5:8F5EAA4F5099B82EDD68893C5D99A0EF
                                                                                                                                                                                                                          SHA1:1B21DAD0CD54E083A6EADCFD57CA8F58759189AD
                                                                                                                                                                                                                          SHA-256:1A46357BC4FE682AF78FFAB10A6A88893BEF50AECC6ACA217A5EBC1B98C01C07
                                                                                                                                                                                                                          SHA-512:2C82822CCA208E900383A1B55882BFC3559EC116C5B5AD2452BA367594AEF36F34C316FFA18B2BAB71A82FC382559069385947548EE9902FEDCDED084801ABF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santarem) {. {-9223372036854775808 -13128 0 LMT}. {-1767212472 -14400 0 -04}. {-1206954000 -10800 1 -04}. {-1191358800 -14400 0 -04}. {-1175371200 -10800 1 -04}. {-1159822800 -14400 0 -04}. {-633816000 -10800 1 -04}. {-622065600 -14400 0 -04}. {-602280000 -10800 1 -04}. {-591829200 -14400 0 -04}. {-570744000 -10800 1 -04}. {-560206800 -14400 0 -04}. {-539121600 -10800 1 -04}. {-531349200 -14400 0 -04}. {-191361600 -10800 1 -04}. {-184194000 -14400 0 -04}. {-155160000 -10800 1 -04}. {-150066000 -14400 0 -04}. {-128894400 -10800 1 -04}. {-121122000 -14400 0 -04}. {-99950400 -10800 1 -04}. {-89586000 -14400 0 -04}. {-68414400 -10800 1 -04}. {-57963600 -14400 0 -04}. {499752000 -10800 1 -04}. {511239600 -14400 0 -04}. {530596800 -10800 1 -04}. {540270000 -14400 0 -04}. {562132800 -10800 1 -04}. {571201200 -14400 0 -04}. {590036400 -14
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8582
                                                                                                                                                                                                                          Entropy (8bit):3.4381885094053835
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:LCA/E8pYraRo+kP0pDrMb60RnHqhTxxJA3Ea9c0yq/g2tw5E8Q+iWMFeHpkUu9/6:LRNBnrR59bPYUt
                                                                                                                                                                                                                          MD5:47BED3B60EF45B00267B4D628A2F18C4
                                                                                                                                                                                                                          SHA1:B3827DF571CF2CA16074188CE0E3061E296B8B26
                                                                                                                                                                                                                          SHA-256:51BB12A2397CAD3D412C9E8F3BA06DD98CC379F999DB3D00ED651A84DA1D6D1C
                                                                                                                                                                                                                          SHA-512:8DA831A0EAB180C982395F2BA85952959A676AADA87823E56C5B643FEB7082B6605FD3645D880B19F3F9EE5B25353002309CDB37AE68F1B3A192AE1280B74404
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santiago) {. {-9223372036854775808 -16966 0 LMT}. {-2524504634 -16966 0 SMT}. {-1892661434 -18000 0 -05}. {-1688410800 -16966 0 SMT}. {-1619205434 -14400 0 -04}. {-1593806400 -16966 0 SMT}. {-1335986234 -18000 0 -05}. {-1335985200 -14400 1 -05}. {-1317585600 -18000 0 -05}. {-1304362800 -14400 1 -05}. {-1286049600 -18000 0 -05}. {-1272826800 -14400 1 -05}. {-1254513600 -18000 0 -05}. {-1241290800 -14400 1 -05}. {-1222977600 -18000 0 -05}. {-1209754800 -14400 1 -05}. {-1191355200 -18000 0 -05}. {-1178132400 -14400 0 -04}. {-870552000 -18000 0 -05}. {-865278000 -14400 0 -04}. {-740520000 -10800 1 -03}. {-736376400 -14400 0 -04}. {-718056000 -18000 0 -05}. {-713649600 -14400 0 -04}. {-36619200 -10800 1 -04}. {-23922000 -14400 0 -04}. {-3355200 -10800 1 -04}. {7527600 -14400 0 -04}. {24465600 -10800 1 -04}. {37767600 -14400 0 -04}. {55
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):595
                                                                                                                                                                                                                          Entropy (8bit):4.2614212422453726
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5290/SyJmdHhvPu4/G/uFNM/KMVvMj/+MVvMqx/r0XVvMnUB/B7VvMa6I8/0p:cQ+DJeVu4e/uICEkFvxwdqUBZp965VPO
                                                                                                                                                                                                                          MD5:04F2A2C789E041270354376C3FD90D2D
                                                                                                                                                                                                                          SHA1:D0B89262D559021FAC035A519C96D2A2FA417F9C
                                                                                                                                                                                                                          SHA-256:42EF317EA851A781B041DC1951EA5A3EA1E924149C4B868ECD75F24672B28FA8
                                                                                                                                                                                                                          SHA-512:F8D072527ED38C2FF1C9E08219104213352B2EFA1171C0D1E02B6B1542B4929D0C4640B441326791CC86F23206621CD4E0D3247CBAB1F99B63E65DB667F3DFED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Santo_Domingo) {. {-9223372036854775808 -16776 0 LMT}. {-2524504824 -16800 0 SDMT}. {-1159773600 -18000 0 EST}. {-100119600 -14400 1 EDT}. {-89668800 -18000 0 EST}. {-5770800 -16200 1 -0430}. {4422600 -18000 0 EST}. {25678800 -16200 1 -0430}. {33193800 -18000 0 EST}. {57733200 -16200 1 -0430}. {64816200 -18000 0 EST}. {89182800 -16200 1 -0430}. {96438600 -18000 0 EST}. {120632400 -16200 1 -0430}. {127974600 -18000 0 EST}. {152082000 -14400 0 AST}. {975823200 -14400 0 AST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7552
                                                                                                                                                                                                                          Entropy (8bit):3.4588792656032914
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Lam19U2gUGrpzsVE0OjmicnyVkHZWWWE/+ZqPuWcBpR4xHtMlAbGCoGzvGmFGgh4:L3Yc8u9U
                                                                                                                                                                                                                          MD5:DEA27A3FE65A22BE42A97C6AB58E9687
                                                                                                                                                                                                                          SHA1:CD50184C4D1739CF5568E21683980FC63C9BFF24
                                                                                                                                                                                                                          SHA-256:AFA706258270F20F9317FF5B84957A2DF77842D564922C15DC302F7A8AB59CEC
                                                                                                                                                                                                                          SHA-512:34C306EC889C10988B3D9C236903417BCA1590E96CD60AE700882C064CCC410132265F106BB10D9593AFFA32B923728FBDDFB6DEE77CAF4A058C877F4D5F1EF1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sao_Paulo) {. {-9223372036854775808 -11188 0 LMT}. {-1767214412 -10800 0 -03}. {-1206957600 -7200 1 -03}. {-1191362400 -10800 0 -03}. {-1175374800 -7200 1 -03}. {-1159826400 -10800 0 -03}. {-633819600 -7200 1 -03}. {-622069200 -10800 0 -03}. {-602283600 -7200 1 -03}. {-591832800 -10800 0 -03}. {-570747600 -7200 1 -03}. {-560210400 -10800 0 -03}. {-539125200 -7200 1 -03}. {-531352800 -10800 0 -03}. {-195429600 -7200 1 -02}. {-189381600 -7200 0 -03}. {-184197600 -10800 0 -03}. {-155163600 -7200 1 -03}. {-150069600 -10800 0 -03}. {-128898000 -7200 1 -03}. {-121125600 -10800 0 -03}. {-99954000 -7200 1 -03}. {-89589600 -10800 0 -03}. {-68418000 -7200 1 -03}. {-57967200 -10800 0 -03}. {499748400 -7200 1 -03}. {511236000 -10800 0 -03}. {530593200 -7200 1 -03}. {540266400 -10800 0 -03}. {562129200 -7200 1 -03}. {571197600 -10800 0 -03}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6593
                                                                                                                                                                                                                          Entropy (8bit):3.4670685654529194
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:URW/ukG9UDHaXZgsP/N/LWAWVF20V/VapcJlNcnkF0:BuZUDHaXZgsN/FWVFjHv0
                                                                                                                                                                                                                          MD5:7E7EF4D67CCD455833603F7EF9E374A6
                                                                                                                                                                                                                          SHA1:4AD722F75FC88572DD5A2CD1845FF5F68ED4B58A
                                                                                                                                                                                                                          SHA-256:2B5B2A00793545C8D32437D7DAA2A36B42D3B1B7421054621841E2919F713294
                                                                                                                                                                                                                          SHA-512:0688EB3EBDE78E18EE5E31DE57F1CBE0BF10071A6EDC97D284B2B3E1E22975262190934446C202E90EFD161686F4790342EDDBCACADB3A65B0AC6C1A9099C79F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Scoresbysund) {. {-9223372036854775808 -5272 0 LMT}. {-1686090728 -7200 0 -02}. {323841600 -3600 0 -01}. {338961600 -7200 0 -02}. {354679200 0 0 +00}. {370400400 -3600 0 -01}. {386125200 0 1 +00}. {401850000 -3600 0 -01}. {417574800 0 1 +00}. {433299600 -3600 0 -01}. {449024400 0 1 +00}. {465354000 -3600 0 -01}. {481078800 0 1 +00}. {496803600 -3600 0 -01}. {512528400 0 1 +00}. {528253200 -3600 0 -01}. {543978000 0 1 +00}. {559702800 -3600 0 -01}. {575427600 0 1 +00}. {591152400 -3600 0 -01}. {606877200 0 1 +00}. {622602000 -3600 0 -01}. {638326800 0 1 +00}. {654656400 -3600 0 -01}. {670381200 0 1 +00}. {686106000 -3600 0 -01}. {701830800 0 1 +00}. {717555600 -3600 0 -01}. {733280400 0 1 +00}. {749005200 -3600 0 -01}. {764730000 0 1 +00}. {780454800 -3600 0 -01}. {796179600 0 1 +00}. {811904400 -3600 0 -01}. {828234000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.840231755053259
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L2IAcGEtOFBx+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iL290tO09G
                                                                                                                                                                                                                          MD5:65307038DB12A7A447284DF4F3E6A3E8
                                                                                                                                                                                                                          SHA1:DC28D6863986D7A158CEF239D46BE9F5033DF897
                                                                                                                                                                                                                          SHA-256:3FD862C9DB2D5941DFDBA5622CC53487A7FC5039F7012B78D3EE4B58753D078D
                                                                                                                                                                                                                          SHA-512:91BC29B7EC9C49D4020DC26F682D0EFBBBEE83D10D79C766A08C78D5FF04D9C0A09288D9696A378E777B65E0C2C2AC8A218C12F86C45BD6E7B5E204AE5FC2335
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:America/Shiprock) $TZData(:America/Denver).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8376
                                                                                                                                                                                                                          Entropy (8bit):3.8793735356495116
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:lG19jJps/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:lM9jI/4h5sBPy+CMt/ElALLVuAH
                                                                                                                                                                                                                          MD5:2F2C91BD29B32A281F9FB1F811953ACB
                                                                                                                                                                                                                          SHA1:49102C37397CC9B7CDCDCE6A76F9BE03D0B446AB
                                                                                                                                                                                                                          SHA-256:6ABBF55FEE7839B9EEEBB97EA53E185E1A0E189843531257708258841A35EB76
                                                                                                                                                                                                                          SHA-512:FB06D4FE28BD9DD9D56A7365F1E2CC7434678B8850CECF99A232F07B4B720F092980EC337C279E599A12E54548DE6AC253547FE4C255BEFA7B545F8C93375589
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Sitka) {. {-9223372036854775808 53927 0 LMT}. {-3225223727 -32473 0 LMT}. {-2188954727 -28800 0 PST}. {-883584000 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-757353600 -28800 0 PST}. {-31507200 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -28800 0 PST}. {294228000 -25200 1 PDT}. {309949200 -28800 0 PST}. {325677600 -
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):208
                                                                                                                                                                                                                          Entropy (8bit):4.905980413237828
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290txP90e/:MBaIMY9QpI2907P90O
                                                                                                                                                                                                                          MD5:B6E45D20EB8CC73A77B9A75578E5C246
                                                                                                                                                                                                                          SHA1:19C6BB6ED12B6943CF7BDFFE4C8A8D72DB491E44
                                                                                                                                                                                                                          SHA-256:31E60EAC8ABFA8D3DAD501D3BCDCA7C4DB7031B65ADDA24EC11A6DEE1E3D14C3
                                                                                                                                                                                                                          SHA-512:C0F3BF8D106E77C1000E45D0A6C8E7C05B7B97EFA2EECCA45FEF48EB42FBDD5336FD551C794064EADFB6919A12813FF66B2F95722877432B4A48B1FBA6C5409D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Barthelemy) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10917
                                                                                                                                                                                                                          Entropy (8bit):3.7872036312069963
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Vvprjhbvd8mSGu9EnkBVAZK2GrbrvZeuqpNFT:Vvbvd7SGu9lzoVpDT
                                                                                                                                                                                                                          MD5:F87531D6DC9AAFB2B0F79248C5ADA772
                                                                                                                                                                                                                          SHA1:E14C52B0F564FA3A3536B7576A2B27D4738CA76B
                                                                                                                                                                                                                          SHA-256:0439DA60D4C52F0E777431BF853D366E2B5D89275505201080954D88F6CA9478
                                                                                                                                                                                                                          SHA-512:5B43CE25D970EEEFD09865D89137388BD879C599191DE8ACE37DA657C142B6DF63143DBF9DED7659CBD5E45BAB699E2A3AFDD28C76A7CB2F300EBD9B74CDA59D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/St_Johns) {. {-9223372036854775808 -12652 0 LMT}. {-2713897748 -12652 0 NST}. {-1664130548 -9052 1 NDT}. {-1650137348 -12652 0 NST}. {-1640982548 -12652 0 NST}. {-1632076148 -9052 1 NDT}. {-1615145348 -12652 0 NST}. {-1609446548 -12652 0 NST}. {-1598650148 -9052 1 NDT}. {-1590100148 -12652 0 NST}. {-1567286948 -9052 1 NDT}. {-1551565748 -12652 0 NST}. {-1535837348 -9052 1 NDT}. {-1520116148 -12652 0 NST}. {-1503782948 -9052 1 NDT}. {-1488666548 -12652 0 NST}. {-1472333348 -9052 1 NDT}. {-1457216948 -12652 0 NST}. {-1440883748 -9052 1 NDT}. {-1425767348 -12652 0 NST}. {-1409434148 -9052 1 NDT}. {-1394317748 -12652 0 NST}. {-1377984548 -9052 1 NDT}. {-1362263348 -12652 0 NST}. {-1346534948 -9052 1 NDT}. {-1330813748 -12652 0 NST}. {-1314480548 -9052 1 NDT}. {-1299364148 -12652 0 NST}. {-1283030948 -9052 1 NDT}. {-1267914548 -12652 0 NS
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):203
                                                                                                                                                                                                                          Entropy (8bit):4.878034750755565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290tMp490e/:MBaIMY9QpI290g490O
                                                                                                                                                                                                                          MD5:B149DC2A23F741BA943E5511E35370D3
                                                                                                                                                                                                                          SHA1:3C8D3CFDB329B7ECB90C19D3EB3DE6F33A063ADD
                                                                                                                                                                                                                          SHA-256:36046A74F6BB23EA8EABA25AD3B93241EBB509EF1821CC4BEC860489F5EC6DCA
                                                                                                                                                                                                                          SHA-512:CEB38EC2405A3B0A4E09CDD2D69A11884CCB28DA0FD7CF8B344E1472642A0571674D3ED33C639E745DDEEE741E52B0948B86DFFFD324BB07A9F1A6B9F38F898E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Kitts) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):203
                                                                                                                                                                                                                          Entropy (8bit):4.89157166321909
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0uPXoFVAIg20uPXhF2IAcGEtkS+IAcGEuPX/:SlSWB9IZaM3y7eoFVAIgpeX290tY90e/
                                                                                                                                                                                                                          MD5:7B7FCA150465F48FAC9F392C079B6376
                                                                                                                                                                                                                          SHA1:1B501288CC00E8B90A2FAD82619B49A9DDBE4475
                                                                                                                                                                                                                          SHA-256:87203A4BF42B549FEBF467CC51E8BCAE01BE1A44C193BED7E2D697B1C3D268C9
                                                                                                                                                                                                                          SHA-512:5E4F7EE08493547A012144884586D45020D83B5838254C257FD341B8B6D3F9E279013D068EFC7D6DF7569DDD20122B3B23E9C93A0017FB64E941A50311ED1F18
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Lucia) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204
                                                                                                                                                                                                                          Entropy (8bit):4.888871207225013
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290tXIMFJ490e/:MBaIMY9QpI290tJ490O
                                                                                                                                                                                                                          MD5:7E272CE31D788C2556FF7421F6832314
                                                                                                                                                                                                                          SHA1:A7D89A1A9AC2B61D98690126D1E4C1595E160C8F
                                                                                                                                                                                                                          SHA-256:F0E10D45C929477A803085B2D4CE02EE31FD1DB24855836D02861AD246BC34D9
                                                                                                                                                                                                                          SHA-512:CCDF0B1B5971B77F6FA27F25900DB1AB9A4A4C69E15DCDF4EA35E1E1FC31AAD957C2E5862B411B0155BB1E25E2DD417A89168295317B1E603DA59142D76CE80A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Thomas) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):205
                                                                                                                                                                                                                          Entropy (8bit):4.876306758637305
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290tzb+Q90e/:MBaIMY9QpI290xyQ90O
                                                                                                                                                                                                                          MD5:52DAAF1636B5B70E0BA2015E9F322A74
                                                                                                                                                                                                                          SHA1:4BD05207601CF6DB467C27052EBB25C9A64DAC96
                                                                                                                                                                                                                          SHA-256:A5B3687BBA1D14D52599CB355BA5F4399632BF98DF4CEB258F9C479B1EA73586
                                                                                                                                                                                                                          SHA-512:E3DE0447236F6EA24D173CCB46EA1A4A31B5FFBCE2A442CD542DA8C54DAD22391FD1CA301776C0FB07CBCF256FC708E61B7BBA682C02EEBE03BECCEA2B6D3BD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/St_Vincent) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):845
                                                                                                                                                                                                                          Entropy (8bit):4.182525430299964
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQce7eUFLxsOCX+FmFyyFDVFdPFxFZA8uFZYV:5NecLGO+6yZzXDZA8KZG
                                                                                                                                                                                                                          MD5:1502A6DD85B55B9619E42D1E08C09738
                                                                                                                                                                                                                          SHA1:70FF58E29CCDB53ABABA7EBD449A9B34AC152AA6
                                                                                                                                                                                                                          SHA-256:54E541D1F410AFF34CE898BBB6C7CC945B66DFC9D7C4E986BD9514D14560CC6F
                                                                                                                                                                                                                          SHA-512:99F0EFF9F2DA4CDD6AB508BB85002F38B01BDFDE0CBA1EB2F4B5CA8EAD8AAB645A3C26BECF777DE49574111B37F847EFF9320331AC07E84C8E892B688B01D36B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Swift_Current) {. {-9223372036854775808 -25880 0 LMT}. {-2030201320 -25200 0 MST}. {-1632063600 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-747241200 -21600 0 MDT}. {-732729600 -25200 0 MST}. {-715791600 -21600 1 MDT}. {-702489600 -25200 0 MST}. {-684342000 -21600 1 MDT}. {-671040000 -25200 0 MST}. {-652892400 -21600 1 MDT}. {-639590400 -25200 0 MST}. {-631126800 -25200 0 MST}. {-400086000 -21600 1 MDT}. {-384364800 -25200 0 MST}. {-337186800 -21600 1 MDT}. {-321465600 -25200 0 MST}. {-305737200 -21600 1 MDT}. {-292435200 -25200 0 MST}. {-273682800 -21600 1 MDT}. {-260985600 -25200 0 MST}. {73472400 -21600 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):329
                                                                                                                                                                                                                          Entropy (8bit):4.580220354026118
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5290Em2OHskeRbV1UcgdrV/uFn/acD3/uFn/sb9/uFn/yn:MBp5290EmdHsVH1UDB/uFn/z/uFn/k/N
                                                                                                                                                                                                                          MD5:004588073FADF67C3167FF007759BCEA
                                                                                                                                                                                                                          SHA1:64A6344776A95E357071D4FC65F71673382DAF9D
                                                                                                                                                                                                                          SHA-256:55C18EA96D3BA8FD9E8C4F01D4713EC133ACCD2C917EC02FD5E74A4E0089BFBF
                                                                                                                                                                                                                          SHA-512:ADC834C393C5A3A7BFD86A933E7C7F594AC970A3BD1E38110467A278DC4266D81C3E96394C102E565F05DE7FBBDA623C673597E19BEC1EA26AB12E4354991066
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tegucigalpa) {. {-9223372036854775808 -20932 0 LMT}. {-1538503868 -21600 0 CST}. {547020000 -18000 1 CDT}. {559717200 -21600 0 CST}. {578469600 -18000 1 CDT}. {591166800 -21600 0 CST}. {1146981600 -18000 1 CDT}. {1154926800 -21600 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6666
                                                                                                                                                                                                                          Entropy (8bit):3.7481713130223295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:pJunToVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4zjyvUP/ZbJitpJxSIRj:pAWJv
                                                                                                                                                                                                                          MD5:8FFE81344C31A51489A254DE97E83C3E
                                                                                                                                                                                                                          SHA1:4397D9EDAC304668D95921EF03DFD90F967E772F
                                                                                                                                                                                                                          SHA-256:EF6AF4A3FA500618B37AF3CDD40C475E54347D7510274051006312A42C79F20C
                                                                                                                                                                                                                          SHA-512:F34A6D44499DE5A4E328A8EAFBA5E77B1B8C04A843160D74978398F1545C821C3034FCBD5ADBFAD8D14D1688907C57E7570023ABD3096D4E4C19E3D3C04428B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thule) {. {-9223372036854775808 -16508 0 LMT}. {-1686079492 -14400 0 AST}. {670399200 -10800 1 ADT}. {686120400 -14400 0 AST}. {701848800 -10800 1 ADT}. {717570000 -14400 0 AST}. {733903200 -10800 1 ADT}. {752043600 -14400 0 AST}. {765352800 -10800 1 ADT}. {783493200 -14400 0 AST}. {796802400 -10800 1 ADT}. {814942800 -14400 0 AST}. {828856800 -10800 1 ADT}. {846392400 -14400 0 AST}. {860306400 -10800 1 ADT}. {877842000 -14400 0 AST}. {891756000 -10800 1 ADT}. {909291600 -14400 0 AST}. {923205600 -10800 1 ADT}. {941346000 -14400 0 AST}. {954655200 -10800 1 ADT}. {972795600 -14400 0 AST}. {986104800 -10800 1 ADT}. {1004245200 -14400 0 AST}. {1018159200 -10800 1 ADT}. {1035694800 -14400 0 AST}. {1049608800 -10800 1 ADT}. {1067144400 -14400 0 AST}. {1081058400 -10800 1 ADT}. {1099198800 -14400 0 AST}. {1112508000 -10800 1 ADT}. {1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8058
                                                                                                                                                                                                                          Entropy (8bit):3.7473289441354263
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:hePraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:hirrn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:CE6E17F16AA8BAD3D9DB8BD2E61A6406
                                                                                                                                                                                                                          SHA1:7DF466E7BB5EDD8E1CDF0ADC8740248EF31ECB15
                                                                                                                                                                                                                          SHA-256:E29F83A875E2E59EC99A836EC9203D5ABC2355D6BD4683A5AEAF31074928D572
                                                                                                                                                                                                                          SHA-512:833300D17B7767DE74E6F2757513058FF5B25A9E7A04AB97BBBFFAC5D9ADCC43366A5737308894266A056382D2589D0778EEDD85D56B0F336C84054AB05F1079
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Thunder_Bay) {. {-9223372036854775808 -21420 0 LMT}. {-2366733780 -21600 0 CST}. {-1893434400 -18000 0 EST}. {-883594800 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {18000 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {94712400 -18000 0 EST}. {126248400 -18000 0 EST}. {136364400 -14400 1 EDT}. {152085600 -18000 0 EST}. {167814000 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -18000 0 EST}. {294217200 -14400 1 EDT}. {309938400 -18000 0 EST}. {325666800 -14400 1 EDT}. {341388000 -18000 0 EST}. {357116400 -14400 1 EDT}. {372837600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8470
                                                                                                                                                                                                                          Entropy (8bit):3.767364707906483
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:mb4O5mC2ZCAFBWsBNwj/lpmlOxGcKcnRH31t+ucgge:Q5DaYaNwj/lpmlOxnKcndIG
                                                                                                                                                                                                                          MD5:F76D5FB5BC773872B556A6EDF660E5CC
                                                                                                                                                                                                                          SHA1:3FD19FCD0FFD3308D2E7D9A3553C14B6A6C3A903
                                                                                                                                                                                                                          SHA-256:170540AA3C0962AFE4267F83AC679241B2D135B1C18E8E7220C2608B94DDDE0E
                                                                                                                                                                                                                          SHA-512:7FC5D2BC39EF3A3C902A56272474E28CD9C56DE37A7AE9FAEADE974993677CCF3A9E6CE64C064D69B7587BD47951BFFFD751412D97F4066656CBB42AD9B619DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Tijuana) {. {-9223372036854775808 -28084 0 LMT}. {-1514736000 -25200 0 MST}. {-1451667600 -28800 0 PST}. {-1343062800 -25200 0 MST}. {-1234803600 -28800 0 PST}. {-1222963200 -25200 1 PDT}. {-1207242000 -28800 0 PST}. {-873820800 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-761677200 -28800 0 PST}. {-686073600 -25200 1 PDT}. {-661539600 -28800 0 PST}. {-504892800 -28800 0 PST}. {-495039600 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463590000 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431535600 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400086000 -25200 1 PDT}. {-386780400 -28800 0 PST}. {-368636400 -25200 1 PDT}. {-355330800 -28800 0 PST}. {-337186800 -25200 1 PDT}. {-323881200 -28800 0 PST}. {-305737200 -25200 1 PDT}. {-292431600 -28800 0 PST}. {-283968000 -28800 0 PST}. {189331200 -28800 0 PST}. {199274400 -25200 1 PDT}. {21560
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10883
                                                                                                                                                                                                                          Entropy (8bit):3.7202964099536917
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:9wUYG1dbgZ8UMrEUWraC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:9wS1dbgZ8UMrVWrrn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:9C60AFDFA3BA2002BA68673B778194CF
                                                                                                                                                                                                                          SHA1:D6D17C82AEC4B85BA7B0F6FCB36A7582CA26A82B
                                                                                                                                                                                                                          SHA-256:7744DB6EFE39D636F1C88F8325ED3EB6BF8FA615F52A60333A58BCE579983E87
                                                                                                                                                                                                                          SHA-512:3C793BB00725CF37474683EAB70A0F2B2ACAE1656402CDD7E75182988DC20361A8651A624A5220983E3E05333B9817DCBEAF20D34BD55C5128F55474A02A9455
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Toronto) {. {-9223372036854775808 -19052 0 LMT}. {-2366736148 -18000 0 EST}. {-1632070800 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1609441200 -18000 0 EST}. {-1601753400 -14400 1 EDT}. {-1583697600 -18000 0 EST}. {-1567357200 -14400 1 EDT}. {-1554667200 -18000 0 EST}. {-1534698000 -14400 1 EDT}. {-1524074400 -18000 0 EST}. {-1503248400 -14400 1 EDT}. {-1492365600 -18000 0 EST}. {-1471798800 -14400 1 EDT}. {-1460916000 -18000 0 EST}. {-1440954000 -14400 1 EDT}. {-1428861600 -18000 0 EST}. {-1409504400 -14400 1 EDT}. {-1397412000 -18000 0 EST}. {-1378054800 -14400 1 EDT}. {-1365962400 -18000 0 EST}. {-1346605200 -14400 1 EDT}. {-1333908000 -18000 0 EST}. {-1315155600 -14400 1 EDT}. {-1301853600 -18000 0 EST}. {-1283706000 -14400 1 EDT}. {-1270404000 -18000 0 EST}. {-1252256400 -14400 1 EDT}. {-1238954400 -18000 0 EST}. {-1220806800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):202
                                                                                                                                                                                                                          Entropy (8bit):4.854311472609309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290RRKl290e/:MBaIMY9QpI290V90O
                                                                                                                                                                                                                          MD5:B931564D937C807282F1432FF6EA52A6
                                                                                                                                                                                                                          SHA1:7ECA025D97717EEA7C91B5390122D3A47A25CAD0
                                                                                                                                                                                                                          SHA-256:FF5CF153C4EC65E7E57A608A481F12939B6E4ACC8D62C5B01FEB5A04769A6F07
                                                                                                                                                                                                                          SHA-512:97271500C7D7959B90A6AC0A98D5D0D29DA00E92F9FC973594267DF906DEE767243698DBA2F3A0CF00156E949E29CDDD45A151F263583514090717CFDF1FB4DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Tortola) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9495
                                                                                                                                                                                                                          Entropy (8bit):3.7630000632404426
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:2f7f/5LB6xi9C7Nf+aNwj/lpmlOxnKcndIG:2f735LB6xi9cfefnK6
                                                                                                                                                                                                                          MD5:1ACC41DA124C0CA5E67432760FDC91EC
                                                                                                                                                                                                                          SHA1:13F56C3F53076E0027BB8C5814EC81256A37F4AF
                                                                                                                                                                                                                          SHA-256:DFC19B5231F6A0AB9E9B971574FB612695A425A3B290699DF2819D46F1250DB0
                                                                                                                                                                                                                          SHA-512:2F2E358F5743248DE946B90877EFCCCACAF039956249F17D24B7DA026830A181A125045E2C8937A6ACD674E32887049F2D36A1941F09803DF514ADCDA4055CC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Vancouver) {. {-9223372036854775808 -29548 0 LMT}. {-2713880852 -28800 0 PST}. {-1632060000 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-747237600 -25200 1 PDT}. {-732726000 -28800 0 PST}. {-715788000 -25200 1 PDT}. {-702486000 -28800 0 PST}. {-684338400 -25200 1 PDT}. {-671036400 -28800 0 PST}. {-652888800 -25200 1 PDT}. {-639586800 -28800 0 PST}. {-620834400 -25200 1 PDT}. {-608137200 -28800 0 PST}. {-589384800 -25200 1 PDT}. {-576082800 -28800 0 PST}. {-557935200 -25200 1 PDT}. {-544633200 -28800 0 PST}. {-526485600 -25200 1 PDT}. {-513183600 -28800 0 PST}. {-495036000 -25200 1 PDT}. {-481734000 -28800 0 PST}. {-463586400 -25200 1 PDT}. {-450284400 -28800 0 PST}. {-431532000 -25200 1 PDT}. {-418230000 -28800 0 PST}. {-400082400 -25200 1 PDT}. {-386
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):201
                                                                                                                                                                                                                          Entropy (8bit):4.901732290886438
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7eoFVAIgpeX290RXgr490e/:MBaIMY9QpI290xg090O
                                                                                                                                                                                                                          MD5:DEB77B4016D310DFB38E6587190886FB
                                                                                                                                                                                                                          SHA1:B308A2D187C153D3ED821B205A4F2D0F73DA94B0
                                                                                                                                                                                                                          SHA-256:A6B8CFE8B9381EC61EAB553CFA2A815F93BBB224A6C79D74C08AC54BE4B8413B
                                                                                                                                                                                                                          SHA-512:04A0D598A24C0F3A1881D3412352F65C610F75281CC512B46248847A798A12AEA551E3DE9EA3FD5BB6B3687A0BB65746392F301F72746876D30697D66B3A3604
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Port_of_Spain)]} {. LoadTimeZoneFile America/Port_of_Spain.}.set TZData(:America/Virgin) $TZData(:America/Port_of_Spain).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7613
                                                                                                                                                                                                                          Entropy (8bit):3.789738507183991
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:hmD+C2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:hm3Nf+aNwj/lpmlOxnKcndIG
                                                                                                                                                                                                                          MD5:CBCFD98E08FCCEB580F66AFE8E670AF5
                                                                                                                                                                                                                          SHA1:7E922CCD99CD7758709205E4C9210A2F09F09800
                                                                                                                                                                                                                          SHA-256:72992080AA9911184746633C7D6E47570255EE85CC6FE5E843F62331025B2A61
                                                                                                                                                                                                                          SHA-512:18290654E5330186B739DEDBC7D6860FD017D089DAE19E480F868E1FB56A3CF2E685D0099C4CF1D4F2AE5F36D0B72ABE52FBAC29AD4F6AB8A45C4C420D90E2D5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Whitehorse) {. {-9223372036854775808 -32412 0 LMT}. {-2188997988 -32400 0 YST}. {-1632056400 -28800 1 YDT}. {-1615125600 -32400 0 YST}. {-1596978000 -28800 1 YDT}. {-1583164800 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-147884400 -25200 1 YDDT}. {-131554800 -32400 0 YST}. {315561600 -28800 0 PST}. {325677600 -25200 1 PDT}. {341398800 -28800 0 PST}. {357127200 -25200 1 PDT}. {372848400 -28800 0 PST}. {388576800 -25200 1 PDT}. {404902800 -28800 0 PST}. {420026400 -25200 1 PDT}. {436352400 -28800 0 PST}. {452080800 -25200 1 PDT}. {467802000 -28800 0 PST}. {483530400 -25200 1 PDT}. {499251600 -28800 0 PST}. {514980000 -25200 1 PDT}. {530701200 -28800 0 PST}. {544615200 -25200 1 PDT}. {562150800 -28800 0 PST}. {576064800 -25200 1 PDT}. {594205200 -28800 0 PST}. {607514400 -25200 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9379
                                                                                                                                                                                                                          Entropy (8bit):3.7354364023000937
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:t7K22m2eQ7SRWu3O559BxXWDpws1dwVyUAitGeZiSI0PMnp4ozDCM9LfLPix3QWZ:t7K22m2eQ7Swu3O559BxXWDpws1dwVyU
                                                                                                                                                                                                                          MD5:F6B8A2DA74DC3429EC1FAF7A38CB0361
                                                                                                                                                                                                                          SHA1:1651AD179DB98C9755CDF17FBFC29EF35DE7F588
                                                                                                                                                                                                                          SHA-256:FEAA62063316C8F4AD5FABBF5F2A7DD21812B6658FEC40893657E909DE605317
                                                                                                                                                                                                                          SHA-512:46C61EFF429075A77C01AF1C02FD6136529237B30B7F06795BCEE26CDB75DDAB2D418283CD95C9A0140D1510E02F393F0A7E9414C99D1B31301AE213BAF50681
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Winnipeg) {. {-9223372036854775808 -23316 0 LMT}. {-2602258284 -21600 0 CST}. {-1694368800 -18000 1 CDT}. {-1681671600 -21600 0 CST}. {-1632067200 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1029686400 -18000 1 CDT}. {-1018198800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-746035200 -18000 1 CDT}. {-732733200 -21600 0 CST}. {-715795200 -18000 1 CDT}. {-702493200 -21600 0 CST}. {-684345600 -18000 1 CDT}. {-671043600 -21600 0 CST}. {-652896000 -18000 1 CDT}. {-639594000 -21600 0 CST}. {-620755200 -18000 1 CDT}. {-607626000 -21600 0 CST}. {-589392000 -18000 1 CDT}. {-576090000 -21600 0 CST}. {-557942400 -18000 1 CDT}. {-544640400 -21600 0 CST}. {-526492800 -18000 1 CDT}. {-513190800 -21600 0 CST}. {-495043200 -18000 1 CDT}. {-481741200 -21600 0 CST}. {-463593600 -18000 1 CDT}. {-
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8407
                                                                                                                                                                                                                          Entropy (8bit):3.8776961667057868
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ugOZVKyjVYus/Q7Ddh5sBPyNsSLFOMM/EowALVZVmWa86Eac8rQ:uBZVKH/4h5sBPy+CMt/ElALLVuAH
                                                                                                                                                                                                                          MD5:9C0E781669E3E5549F82ED378EE3423B
                                                                                                                                                                                                                          SHA1:32184EA198156731C58616A0D88F169441C8CC7F
                                                                                                                                                                                                                          SHA-256:FE1C632FE9AF7E54A8CC9ED839818FAE98F14928921FD78C92A8D8E22F07A415
                                                                                                                                                                                                                          SHA-512:D1CDAB3DBAFFB4C30F6EEBDD413D748980C156437FBE99E7DF0C1E17AFA4CC33876AF2BB44C90E1FE5347071E64E83823EED47AE9BE39863C12989CB3EA44BDA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yakutat) {. {-9223372036854775808 52865 0 LMT}. {-3225223727 -33535 0 LMT}. {-2188953665 -32400 0 YST}. {-883580400 -32400 0 YST}. {-880203600 -28800 1 YWT}. {-769395600 -28800 1 YPT}. {-765381600 -32400 0 YST}. {-757350000 -32400 0 YST}. {-31503600 -32400 0 YST}. {-21474000 -28800 1 YDT}. {-5752800 -32400 0 YST}. {9975600 -28800 1 YDT}. {25696800 -32400 0 YST}. {41425200 -28800 1 YDT}. {57751200 -32400 0 YST}. {73479600 -28800 1 YDT}. {89200800 -32400 0 YST}. {104929200 -28800 1 YDT}. {120650400 -32400 0 YST}. {126702000 -28800 1 YDT}. {152100000 -32400 0 YST}. {162385200 -28800 1 YDT}. {183549600 -32400 0 YST}. {199278000 -28800 1 YDT}. {215604000 -32400 0 YST}. {230727600 -28800 1 YDT}. {247053600 -32400 0 YST}. {262782000 -28800 1 YDT}. {278503200 -32400 0 YST}. {294231600 -28800 1 YDT}. {309952800 -32400 0 YST}. {325681200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7485
                                                                                                                                                                                                                          Entropy (8bit):3.781666511020802
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:rGzGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:zVUC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:C9050AC32086644B15631E6FBE4D6292
                                                                                                                                                                                                                          SHA1:8C074D0E04CAFB1BDD11953AE77687CFBC53C449
                                                                                                                                                                                                                          SHA-256:447B801066A92624F58C00DA66FBB90B54195F4AB06886AE4796228244E19E85
                                                                                                                                                                                                                          SHA-512:E7C73E67B247F912E774EF245D2323B24DDF75054C7BE9095BC19E3C58CB5AE287747076B2436ABF735738A969DAFCDB128F0BA2C76A0AFAB5449CF157BEB190
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:America/Yellowknife) {. {-9223372036854775808 0 0 -00}. {-1104537600 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-147891600 -18000 1 MDDT}. {-131562000 -25200 0 MST}. {315558000 -25200 0 MST}. {325674000 -21600 1 MDT}. {341395200 -25200 0 MST}. {357123600 -21600 1 MDT}. {372844800 -25200 0 MST}. {388573200 -21600 1 MDT}. {404899200 -25200 0 MST}. {420022800 -21600 1 MDT}. {436348800 -25200 0 MST}. {452077200 -21600 1 MDT}. {467798400 -25200 0 MST}. {483526800 -21600 1 MDT}. {499248000 -25200 0 MST}. {514976400 -21600 1 MDT}. {530697600 -25200 0 MST}. {544611600 -21600 1 MDT}. {562147200 -25200 0 MST}. {576061200 -21600 1 MDT}. {594201600 -25200 0 MST}. {607510800 -21600 1 MDT}. {625651200 -25200 0 MST}. {638960400 -21600 1 MDT}. {657100800 -25200 0 MST}. {671014800 -21600 1 MDT}. {68
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):316
                                                                                                                                                                                                                          Entropy (8bit):4.338100448107153
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52L09xvFJm2OHlFFbQMFUkjtjKNUkMQTVsklkQEJ:MBp52Lc9mdHfFbQMF5jdK3zTVxE
                                                                                                                                                                                                                          MD5:4AD8AC155D466E47A6BF075508DC05ED
                                                                                                                                                                                                                          SHA1:2C911F651B26C27C07756111B5291C63C6954D34
                                                                                                                                                                                                                          SHA-256:282A352404B30C4336C0E09F3C5371393511C602B9E55648FB0251EACC9C715D
                                                                                                                                                                                                                          SHA-512:4A7305653D700FF565C9747C8A4E69A79609EB4748F3FFAA60C5A8548BBFAEC541EB8EAF830FF9202508BEAFAC2A0895BC4A52473FA51EBC74FAD83FCD0EB8F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Casey) {. {-9223372036854775808 0 0 -00}. {-31536000 28800 0 +08}. {1255802400 39600 0 +11}. {1267714800 28800 0 +08}. {1319738400 39600 0 +11}. {1329843600 28800 0 +08}. {1477065600 39600 0 +11}. {1520701200 28800 0 +08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):312
                                                                                                                                                                                                                          Entropy (8bit):4.290371654524798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52L0DTm2OHlFFpwz0/MVSYv/JFFv7VoX/MVSYv/bpVQSbRXhNXSMVSYvx:MBp52LeTmdHfFCjF/LFvOkF/bp6SbRRT
                                                                                                                                                                                                                          MD5:780DA74192C8F569B1450AACE54A0558
                                                                                                                                                                                                                          SHA1:F2650D6D21A4B4AC8D931383ED343CE916252319
                                                                                                                                                                                                                          SHA-256:88A4DBB222E9FD2FFC26D9B5A8657FA6552DF6B3B6A14D951CE1168B5646E8F8
                                                                                                                                                                                                                          SHA-512:7F1E9E5C0F8E2A9D8AC68E19AF3D48D2BEE9840812A219A759475E7D036EA18CB122C40DDB88977079C1831AEF7EFBCB519C691616631D490B3C04382EB993C0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Davis) {. {-9223372036854775808 0 0 -00}. {-409190400 25200 0 +07}. {-163062000 0 0 -00}. {-28857600 25200 0 +07}. {1255806000 18000 0 +05}. {1268251200 25200 0 +07}. {1319742000 18000 0 +05}. {1329854400 25200 0 +07}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):206
                                                                                                                                                                                                                          Entropy (8bit):4.716730745171491
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52L0/3Om2OHlFFbRX82+c6FFpJ6SpQ:MBp52LdmdHfFbx82+ZFDQ
                                                                                                                                                                                                                          MD5:83B53540FADB1A36903E2A619954BFFC
                                                                                                                                                                                                                          SHA1:C9F520043A641104F43FB5422971B4D7A39A421C
                                                                                                                                                                                                                          SHA-256:0E50BA70DE94E6BABC4847C15865867D0F821F6BDDDC0B9750CB6BF13EF5DF3B
                                                                                                                                                                                                                          SHA-512:0AE7FE58EED7EAC03CBFFA2EA32CCBF726DBED0A3B1C20CF1D549CDA801CEB2B54F106787BD15B17DA3D9404E2D84936D50E4A2F63D1A72B0FEBCD8F8EA3195F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/DumontDUrville) {. {-9223372036854775808 0 0 -00}. {-725846400 36000 0 +10}. {-566992800 0 0 -00}. {-415497600 36000 0 +10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2800
                                                                                                                                                                                                                          Entropy (8bit):3.8632793034261463
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQbTetvk4z/7hLiVVitCinq+D18KmvLx0WWuyymPXObf78FCt7WQi2NjM:5sTlKiG+h5mjKIyym+WQNo
                                                                                                                                                                                                                          MD5:A3E1A9DFB6D6F061E60739865E6E0D18
                                                                                                                                                                                                                          SHA1:10C014CB444DEEF093854EE6A415DC17D7C2A4C5
                                                                                                                                                                                                                          SHA-256:975026D38C4BF136769D31215F2908867EC37E568380F864983DD57FFADA4676
                                                                                                                                                                                                                          SHA-512:9425CF1B717FBDFD4EA04AAC06CF5ACE365A4FCC911D85130B910D022ED4261F1FFF431CE63BA538871C7D3CA1EF65490A30BEE975884EB39FC1E5C2D88009D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Macquarie) {. {-9223372036854775808 0 0 -00}. {-2214259200 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-1601719200 0 0 -00}. {-94730400 36000 0 AEST}. {-71136000 39600 1 AEDT}. {-55411200 36000 0 AEST}. {-37267200 39600 1 AEDT}. {-25776000 36000 0 AEST}. {-5817600 39600 1 AEDT}. {5673600 36000 0 AEST}. {25632000 39600 1 AEDT}. {37728000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.6965808819415695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52L0GRHEzyedFkXGm2OHvdFFoVU/VPKVVFSTGFFFjsvUX0VQL:SlSWB9X52L0zyEm2OHlFFzy/UiF/js/G
                                                                                                                                                                                                                          MD5:A07C6FA0B635EC81C5199F2515888C9E
                                                                                                                                                                                                                          SHA1:587AC900E285F6298A7287F10466DFA4683B9A87
                                                                                                                                                                                                                          SHA-256:2D8F0218800F6E0BD645A7270BEAF60A517AE20CBFFD64CF77E3CE4F8F959348
                                                                                                                                                                                                                          SHA-512:76A3590748F698E51BF29A1D3C119A253A8C07E9F77835CCDFC6AC51C554B5888351C95E6012CDADB106B42A384D49E56537FBF8DB9DC5BB791CB115FDB623FD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Mawson) {. {-9223372036854775808 0 0 -00}. {-501206400 21600 0 +06}. {1255809600 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.832254042797831
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL2L0GRHEz6BVfnUDH/uvn:SlSWB9IZaM3ycqIVAIgOboL2L0z6/fvn
                                                                                                                                                                                                                          MD5:0048A7427AC7880B9F6413208B216BC9
                                                                                                                                                                                                                          SHA1:CBB4A29316581CFC7868A779E97DB94F75870F41
                                                                                                                                                                                                                          SHA-256:487D4845885643700B4FF043AC5EA59E2355FD38357809BE12679ECAFFA93030
                                                                                                                                                                                                                          SHA-512:EC107FA59203B7BCB58253E2715380EF70DF5470030B83E1DEA8D1AC4E7D3FB2908E8C7009D8136212871EC3DA8B4C4194FF3290E5A41EEE8E7D07CABE80ECC0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:Antarctica/McMurdo) $TZData(:Pacific/Auckland).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2526
                                                                                                                                                                                                                          Entropy (8bit):3.514598338545733
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5wcS+SGwRShoSdXvuMSuSYSgS1SWFlSqSySSSoyZSWXSHS9SWS3SbSRSBSUS5ShG:tNURMo8XvuMRnHqhTxxJAHXEa9c0yq/4
                                                                                                                                                                                                                          MD5:7738686109BCC8AF5271608FCD04EBFB
                                                                                                                                                                                                                          SHA1:401217F0F69945ADA13F593681D8F13A368BCF94
                                                                                                                                                                                                                          SHA-256:3EECDA7E4507A321A03171658187D2F50F7C6C46E8A1B0831E6B6B6AAFFAC4AC
                                                                                                                                                                                                                          SHA-512:F7982BF9D82B2D7C2C1825AF1FF9178849BB699A50367872C11572E6F8A452619A63C9F97CEAF06FD5104075FBDE70936B8363B993F2571FD9A2B699A1D17521
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Palmer) {. {-9223372036854775808 0 0 -00}. {-157766400 -14400 0 -04}. {-152654400 -14400 0 -04}. {-132955200 -10800 1 -04}. {-121122000 -14400 0 -04}. {-101419200 -10800 1 -04}. {-86821200 -14400 0 -04}. {-71092800 -10800 1 -04}. {-54766800 -14400 0 -04}. {-39038400 -10800 1 -04}. {-23317200 -14400 0 -04}. {-7588800 -10800 0 -03}. {128142000 -7200 1 -03}. {136605600 -10800 0 -03}. {389070000 -14400 0 -04}. {403070400 -10800 1 -04}. {416372400 -14400 0 -04}. {434520000 -10800 1 -04}. {447822000 -14400 0 -04}. {466574400 -10800 1 -04}. {479271600 -14400 0 -04}. {498024000 -10800 1 -04}. {510721200 -14400 0 -04}. {529473600 -10800 1 -04}. {545194800 -14400 0 -04}. {560923200 -10800 1 -04}. {574225200 -14400 0 -04}. {592372800 -10800 1 -04}. {605674800 -14400 0 -04}. {624427200 -10800 1 -04}. {637124400 -14400 0 -04}. {653457600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):145
                                                                                                                                                                                                                          Entropy (8bit):4.778784990010973
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52L0GRHEsKRaXGm2OHvdFFn/H3VVFVGHC:SlSWB9X52L0rRhm2OHlFFn/VVFAHC
                                                                                                                                                                                                                          MD5:8CAED0DB4C911E84AF29910478D0DBD6
                                                                                                                                                                                                                          SHA1:80DE97C9959D58C6BF782A948EED735AB4C423CC
                                                                                                                                                                                                                          SHA-256:9415FA3A573B98A6EBCBFAEEC15B1C52352F2574161648BB977F55072414002F
                                                                                                                                                                                                                          SHA-512:28F27F7EDDF30EB08F8B37ED13219501D14D2AEA4EFA07AFAD36A643BD448E1BD992463C12C47152C99772D755E6EA0198B51B806A05B57743635A9059676EC2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Rothera) {. {-9223372036854775808 0 0 -00}. {218246400 -10800 0 -03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):4.858829912809126
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3ycqIVAIgOboL2L0tlo+plvn:MBaIMdQiO2LMq+p1
                                                                                                                                                                                                                          MD5:51AC23110E7EAB20319EE8EC82F048D2
                                                                                                                                                                                                                          SHA1:7B4DE168A3078041841762F468AE65A2EE6C5322
                                                                                                                                                                                                                          SHA-256:D33E094979B3CE495BEF7109D78F7B77D470AB848E4E2951851A7C57140354BF
                                                                                                                                                                                                                          SHA-512:13E800DFFA3D65F94FAD6B529FC8A29A26F40F4F29DBF19283392733458AD3C6B27E479218A8C123424E965711B4746976E39EB9FD54CD0B57281134FEAC4F31
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:Antarctica/South_Pole) $TZData(:Pacific/Auckland).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):4.7487926695696006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52L0GRHEtWlFeEXGm2OHvdFFpoMdsWYAvn:SlSWB9X52L0tQeLm2OHlFFpbaWYAv
                                                                                                                                                                                                                          MD5:AA415901BB9E53CF7FAEA47E546D9AED
                                                                                                                                                                                                                          SHA1:CF12572D2C4D0ABF12B0450D366944E297744217
                                                                                                                                                                                                                          SHA-256:F161CFAB3E40A0358FF0DEC2EB8ED9231D357FAC20710668B9CE31CDA68E8B96
                                                                                                                                                                                                                          SHA-512:4F90E0EA7086EB729080E77A47C2E998F7AD3BCEA4997DAB06044BCDD2E2E1729A83C679EF2E1D78CD0255C37F24FCC6746518444CC4E96EBB2A0547312D8354
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Syowa) {. {-9223372036854775808 0 0 -00}. {-407808000 10800 0 +03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5174
                                                                                                                                                                                                                          Entropy (8bit):3.411985404081831
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:q4NUwVb0uJjeH7wZjFH7EPzOLrNrnw/ZklmhEJkJdG:jNUwVAuJjs8JmPzO5ngzG
                                                                                                                                                                                                                          MD5:CA4730C864AB3CC903F79BDF0F9E8777
                                                                                                                                                                                                                          SHA1:7B3E9DDB36766F95F9C651CF244EDA9ED22BDDC5
                                                                                                                                                                                                                          SHA-256:E437539A85E91AD95CD100F9628142FEBB455553C95415DB1147FD25948EBF59
                                                                                                                                                                                                                          SHA-512:32EE0CCA0AB92D68D6C21A925E5367730A172C49DC5245A61DA1A39E08317569154C52EC695E3FB43BB40D066C4C0E9625C835A7F6E2EB5DDF0768D48DB99F3C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Troll) {. {-9223372036854775808 0 0 -00}. {1108166400 0 0 +00}. {1111885200 7200 1 +02}. {1130634000 0 0 +00}. {1143334800 7200 1 +02}. {1162083600 0 0 +00}. {1174784400 7200 1 +02}. {1193533200 0 0 +00}. {1206838800 7200 1 +02}. {1224982800 0 0 +00}. {1238288400 7200 1 +02}. {1256432400 0 0 +00}. {1269738000 7200 1 +02}. {1288486800 0 0 +00}. {1301187600 7200 1 +02}. {1319936400 0 0 +00}. {1332637200 7200 1 +02}. {1351386000 0 0 +00}. {1364691600 7200 1 +02}. {1382835600 0 0 +00}. {1396141200 7200 1 +02}. {1414285200 0 0 +00}. {1427590800 7200 1 +02}. {1445734800 0 0 +00}. {1459040400 7200 1 +02}. {1477789200 0 0 +00}. {1490490000 7200 1 +02}. {1509238800 0 0 +00}. {1521939600 7200 1 +02}. {1540688400 0 0 +00}. {1553994000 7200 1 +02}. {1572138000 0 0 +00}. {1585443600 7200 1 +02}. {1603587600 0 0 +00}. {1616893200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):144
                                                                                                                                                                                                                          Entropy (8bit):4.773942010845718
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52L0GRHEoKcMFtXGm2OHvdFFud/bVFXKVVFSTL:SlSWB9X52L0XcMFEm2OHlFFCVFXK/Un
                                                                                                                                                                                                                          MD5:A07C4769267AFA9501BE44BD406ADA34
                                                                                                                                                                                                                          SHA1:86747047EFD1F47FEFC7DA44465EAB53F808C9FB
                                                                                                                                                                                                                          SHA-256:92816E1C4FDE037D982596610A1F6E11D4E7FD408C3B1FAAB7BEC32B09911FE7
                                                                                                                                                                                                                          SHA-512:051A327C898867228C8B1848162C2604BED8456B61533D4A40FBEB9A0069AE2EAF33F79803A0C6A80C6446C34F757A751F4ABC5AC5CCED6C125E2A42D46A022A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Antarctica/Vostok) {. {-9223372036854775808 0 0 -00}. {-380073600 21600 0 +06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.922114908130109
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2XbeLo4cA4FH/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2XbUyAK8H
                                                                                                                                                                                                                          MD5:0F69284483D337DC8202970461A28386
                                                                                                                                                                                                                          SHA1:0D4592B8EBE070119CB3308534FE9A07A758F309
                                                                                                                                                                                                                          SHA-256:3A5DB7C2C71F95C495D0884001F82599E794118452E2748E95A7565523546A8E
                                                                                                                                                                                                                          SHA-512:D9F2618B153BFE4888E893A62128BE0BD59DFAFC824DA629454D5D541A9789536AC029BF73B6E9749409C522F450D53A270D302B2CF084444EA64D9138D77DFE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Arctic/Longyearbyen) $TZData(:Europe/Oslo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166
                                                                                                                                                                                                                          Entropy (8bit):4.7788335911117095
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8t1zVAIgNsM1E2WFK4h4WFK81S:SlSWB9IZaM3yN1zVAIgaM1E2wKs4wK8c
                                                                                                                                                                                                                          MD5:BBAFEA8E55A739C72E69A619C406BD5D
                                                                                                                                                                                                                          SHA1:0C2793114CA716C5DBAF081083DF1E137F1D0A63
                                                                                                                                                                                                                          SHA-256:6E69C5C3C3E1C98F24F5F523EC666B82534C9F33132A93CCC1100F27E594027F
                                                                                                                                                                                                                          SHA-512:7741F2281FDCA8F01A75ABEBF908F0B70320C4C026D90D4B0C283F3E2B8C47C95263569916EF83CAD40C87D5B6E714045D0B43370A263BC7BE80EC3DA62CC82F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Riyadh)]} {. LoadTimeZoneFile Asia/Riyadh.}.set TZData(:Asia/Aden) $TZData(:Asia/Riyadh).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1580
                                                                                                                                                                                                                          Entropy (8bit):3.640808791765599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQveh8mSsOXEFCMiq90DIgb5j6gMJR/4TJTXSATo6SSsMuRFnCYRluoCC1Q0cxfw:50Fqq9iTVrXjS0qBsW
                                                                                                                                                                                                                          MD5:AC511C65052CE2D780FD583E50CB475C
                                                                                                                                                                                                                          SHA1:6B9171A13F6E6F33F878A347173A03112BCF1B89
                                                                                                                                                                                                                          SHA-256:C9739892527CCEBDF91D7E22A6FCD0FD57AAFA6A1B4535915AC82CF6F72F34A4
                                                                                                                                                                                                                          SHA-512:12743486EB02C241C90ECCEDD323D0F560D5FA1F55CB3EBB5AF3A65331D362433F2EAF7285B19335F5C262DA033EB8BE5A4618794EA74DFCD4107C170035CE96
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Almaty) {. {-9223372036854775808 18468 0 LMT}. {-1441170468 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 18000 0 +05}. {670366800 21600 1 +05}. {686091600 18000 0 +05}. {695768400 21600 0 +06}. {701812800 25200 1 +06}. {717537600 21600 0 +06}. {733262400 25200 1 +06}. {748987200 21600 0 +06}. {764712000 25200 1 +06}. {780436800 21
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7055
                                                                                                                                                                                                                          Entropy (8bit):3.621680472512772
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:Rnv8A4XkyKfUN9QXCkFpej4g2uMekzdgyvwKVuKEZhfuITrar2gsq0teU:RvMw2y3p+4g2PxbLS5
                                                                                                                                                                                                                          MD5:703F8A37D41186AC8CDBCB86B9FE6C1B
                                                                                                                                                                                                                          SHA1:B2D7FCBD290DA0FEB31CD310BA29FE27A59822BE
                                                                                                                                                                                                                          SHA-256:847FA8211956C5930930E2D7E760B1D7F551E8CDF99817DB630222C960069EB8
                                                                                                                                                                                                                          SHA-512:66504E448469D2358C228966739F0FEB381BF862866A951B092A600A17DAD80E6331F6D88C4CFCE483F45E79451722A19B37291EDA75C7CD4D7E0A7E82096F47
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Amman) {. {-9223372036854775808 8624 0 LMT}. {-1230776624 7200 0 EET}. {108165600 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {215643600 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EET}. {262735200 10800 1 EEST}. {275950800 7200 0 EET}. {481154400 10800 1 EEST}. {496962000 7200 0 EET}. {512949600 10800 1 EEST}. {528670800 7200 0 EET}. {544399200 10800 1 EEST}. {560120400 7200 0 EET}. {575848800 10800 1 EEST}. {592174800 7200 0 EET}. {610581600 10800 1 EEST}. {623624400 7200 0 EET}. {641167200 10800 1 EEST}. {655074000 7200 0 EET}. {671839200 10800 1 EEST}. {685918800 7200 0 EET}. {702856800 10800 1 EEST}. {717973200 7200 0 EET}. {733701600 10800 1 EEST}. {749422800 7200 0 EET}. {765151200 10800 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2014
                                                                                                                                                                                                                          Entropy (8bit):3.680306971172711
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQMe/VrghhF87/Fpd2kNNxLcULBQdHl2yYvpQ62itgUiRrn5d6kGFF6UERWkBUHA:5ah2zFvpchKvW62XPdXJMwT3Lea
                                                                                                                                                                                                                          MD5:E0396BBBB3FDDD2B651D2DBB4EF90884
                                                                                                                                                                                                                          SHA1:C1FFCDC6EB77B5F4CFAFA90EA8E1025DB142D5C5
                                                                                                                                                                                                                          SHA-256:6A9B4EF8FBED758E8D1737C79D803F9DF4F5BF61F115064ED60DA2397B88FE19
                                                                                                                                                                                                                          SHA-512:8FB6D19189142F11812B82F5803F4E5C85BF107689D317305D32EF71905DC9E0655DD2F2D4CE234B5872A6BF452670221F94EF1D48EF776C002AA5A484C2481B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Anadyr) {. {-9223372036854775808 42596 0 LMT}. {-1441194596 43200 0 +12}. {-1247572800 46800 0 +14}. {354884400 50400 1 +14}. {370692000 46800 0 +13}. {386420400 43200 0 +13}. {386424000 46800 1 +13}. {402231600 43200 0 +12}. {417960000 46800 1 +13}. {433767600 43200 0 +12}. {449582400 46800 1 +13}. {465314400 43200 0 +12}. {481039200 46800 1 +13}. {496764000 43200 0 +12}. {512488800 46800 1 +13}. {528213600 43200 0 +12}. {543938400 46800 1 +13}. {559663200 43200 0 +12}. {575388000 46800 1 +13}. {591112800 43200 0 +12}. {606837600 46800 1 +13}. {622562400 43200 0 +12}. {638287200 46800 1 +13}. {654616800 43200 0 +12}. {670341600 39600 0 +12}. {670345200 43200 1 +12}. {686070000 39600 0 +11}. {695746800 43200 0 +13}. {701791200 46800 1 +13}. {717516000 43200 0 +12}. {733240800 46800 1 +13}. {748965600 43200 0 +12}. {764690400 46
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1607
                                                                                                                                                                                                                          Entropy (8bit):3.623112789966889
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQJeoR9NSVYlS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDS7/S5c3oSATo03CRJS2I:5fZlkhs7bqIwIoMpqDS7oXb0w+sRBlL
                                                                                                                                                                                                                          MD5:410226AA30925F31BA963139FD594AEB
                                                                                                                                                                                                                          SHA1:860E17C83D0DF2CBB4B8E73B9C7CB956994F5549
                                                                                                                                                                                                                          SHA-256:69402CA6D56138A6A6D09964B90D1781A7CBEFBDFFE506B7292758EC24740B0E
                                                                                                                                                                                                                          SHA-512:AE2610D1D779500132D5FA12E7529551ECD009848619C7D802F6EE89B0D2C3D6E7C91FB83DA7616180C166CE9C4499D7A2A4FEB5373621353640A71830B655A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtau) {. {-9223372036854775808 12064 0 LMT}. {-1441164064 14400 0 +04}. {-1247544000 18000 0 +05}. {370724400 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21600 1 +05}. {780440400 180
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1608
                                                                                                                                                                                                                          Entropy (8bit):3.6301391279603696
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5FhXlkhs7bqIwIoMpqDS7oXb0w+bBijbbyzIr1jJL:PtCOgZbdp
                                                                                                                                                                                                                          MD5:B8D914F33D568AE8EB46B7F3FC5BF944
                                                                                                                                                                                                                          SHA1:91DE61EC025E8F74D9CD10816C3534B5F8D397F7
                                                                                                                                                                                                                          SHA-256:9C1C30ADD1919951350C86DA6B716326178CF74A849A3350AE147DD2ADC34049
                                                                                                                                                                                                                          SHA-512:A32B34C15D94C42E9DF13316ACB9E0C9AF151F2EF14F502BE1A75E40735A2BC5D9E59244A72ACFB68184DA0D62A48FCC7AB288F1BA85DBB4DC385FA04BF3075D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Aqtobe) {. {-9223372036854775808 13720 0 LMT}. {-1441165720 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):847
                                                                                                                                                                                                                          Entropy (8bit):3.852939540326754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQgZeRHINS62DS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDS7/S5c3oSATo03CRJL:5g8U0khs7bqIwIoMpqDS7oXb0L
                                                                                                                                                                                                                          MD5:BFDAC4AE48AD49E5C0A048234586507E
                                                                                                                                                                                                                          SHA1:ACFE49AED50D0FDF2978034BB3098331F6266CC8
                                                                                                                                                                                                                          SHA-256:77FB5A9F578E75EEC3E3B83618C99F33A04C19C8BB9AFB314888091A8DD64AA3
                                                                                                                                                                                                                          SHA-512:11B412E0856BD384080B982C9DE6CE196E8C71A68096F7ED22972B7617533F9BD92EFA4C153F2CEE7EA4F0DE206281B6B9066C5969AFFE913AF2FA5CF82EDD90
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ashgabat) {. {-9223372036854775808 14012 0 LMT}. {-1441166012 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +05}. {370720800 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.750782589043179
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8xEYM4DdVAIgN/ZEYvCHt2WFKUNSH+WFKYEYMvn:SlSWB9IZaM3yRhVAIgH1CHt2wKUNSewa
                                                                                                                                                                                                                          MD5:73E1F618FB430C503A1499E3A0298C97
                                                                                                                                                                                                                          SHA1:29F31A7C9992F9D9B3447FCBC878F1AF8E4BD57F
                                                                                                                                                                                                                          SHA-256:5917FC603270C0470D2EC416E6C85E999A52B6A384A2E1C5CFC41B29ABCA963A
                                                                                                                                                                                                                          SHA-512:FAE39F158A4F47B4C37277A1DC77B8524DD4287EBAD5D8E6CBB906184E6DA275A308B55051114F4CD4908B449AE3C8FD48384271E3F7106801AD765E5958B4DD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ashgabat)]} {. LoadTimeZoneFile Asia/Ashgabat.}.set TZData(:Asia/Ashkhabad) $TZData(:Asia/Ashgabat).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1608
                                                                                                                                                                                                                          Entropy (8bit):3.6351436957032477
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:55IZlkhs7bqIwIoMpqDS7oXb0w+bBijbbyblL:X8COgZbd4x
                                                                                                                                                                                                                          MD5:F2A86E76222B06103F6C1E8F89EB453E
                                                                                                                                                                                                                          SHA1:D73938EBCA8C1340A7C86E865492EE581DFFC393
                                                                                                                                                                                                                          SHA-256:211AB2318746486C356091EC2D3508D6FB79B9EBC78FC843BF2ADC96A38C4217
                                                                                                                                                                                                                          SHA-512:B5F4F8FF11FA6D113B23F60D64E1737C7FABDDEBF12C37138F0FA05254E6C1643A2D3CA6C322943F4E877CE2E3736CF0F0741DD390C79E7EE94D56361B14BF45
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Atyrau) {. {-9223372036854775808 12464 0 LMT}. {-1441164464 10800 0 +03}. {-1247540400 18000 0 +05}. {370724400 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {695772000 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21600 1 +05}. {780440400 18
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1643
                                                                                                                                                                                                                          Entropy (8bit):3.6348723729667975
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQcTe0yZH76UtjUtUVmFbmU0cybUJN2cU2U9U56UJMlUoCUUbu/UTbU4UdTbU8U6:5cp6pLmFsyN2LouCIpYZgrCi
                                                                                                                                                                                                                          MD5:2C0422E86BA0AECAA97CA01F3A27B797
                                                                                                                                                                                                                          SHA1:C28FD8530B7895B4631EA0CAE03E6019561C4C40
                                                                                                                                                                                                                          SHA-256:D5D69D7A4FE29761C5C3FFBB41A4F8B6B5F2101A34678B1FA9B1D39FC5478EA8
                                                                                                                                                                                                                          SHA-512:3C346DE7E82B8EF1783F5A6D8A6099F7A530DD29AD48EDBB72F019ADC47155A703845503B1DD2589315BB67FA40AEF584313150686248DF45F983781F4B18710
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baghdad) {. {-9223372036854775808 10660 0 LMT}. {-2524532260 10656 0 BMT}. {-1641005856 10800 0 +03}. {389048400 14400 0 +03}. {402264000 10800 0 +03}. {417906000 14400 1 +03}. {433800000 10800 0 +03}. {449614800 14400 1 +03}. {465422400 10800 0 +03}. {481150800 14400 1 +03}. {496792800 10800 0 +03}. {512517600 14400 1 +03}. {528242400 10800 0 +03}. {543967200 14400 1 +03}. {559692000 10800 0 +03}. {575416800 14400 1 +03}. {591141600 10800 0 +03}. {606866400 14400 1 +03}. {622591200 10800 0 +03}. {638316000 14400 1 +03}. {654645600 10800 0 +03}. {670464000 14400 1 +03}. {686275200 10800 0 +03}. {702086400 14400 1 +03}. {717897600 10800 0 +03}. {733622400 14400 1 +03}. {749433600 10800 0 +03}. {765158400 14400 1 +03}. {780969600 10800 0 +03}. {796694400 14400 1 +03}. {812505600 10800 0 +03}. {828316800 14400 1 +03}. {844128000 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166
                                                                                                                                                                                                                          Entropy (8bit):4.732157428331905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8hHVAIgNvZAvxL2WFKENUKMFB/4WFKKu:SlSWB9IZaM3yBHVAIgPAvxL2wKENUr/i
                                                                                                                                                                                                                          MD5:6291D60E3A30B76FEB491CB944BC2003
                                                                                                                                                                                                                          SHA1:3D31032CF518A712FBA49DEC42FF3D99DD468140
                                                                                                                                                                                                                          SHA-256:A462F83DDB0CCC41AC10E0B5B98287B4D89DA8BBBCA869CCFB81979C70613C6C
                                                                                                                                                                                                                          SHA-512:C62D44527EAD47D2281FF951B9CF84C297859CFDC9A497CB92A583B6012B2B9DAAE9924EF17BC6B7CD317B770FF4924D8E1E77ED2E0EBC02502530D132EDE35B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Qatar)]} {. LoadTimeZoneFile Asia/Qatar.}.set TZData(:Asia/Bahrain) $TZData(:Asia/Qatar).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2075
                                                                                                                                                                                                                          Entropy (8bit):3.5206282649651808
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ4ekZqpkb/cXXn8UDu5u8WmFeb/RLc9qENkw/ybt8i9E60339UyuU+DTO1KKlYX:5YTVOZmF7N76eHIAMsiWVyv2Te
                                                                                                                                                                                                                          MD5:460EDC7D17FFA6AF834B6474D8262FB0
                                                                                                                                                                                                                          SHA1:913E117814A5B4B7283A533F47525C8A0C68FD3C
                                                                                                                                                                                                                          SHA-256:0A1FDA259EE5EBC779768BBADACC7E1CCAC56484AA6C03F7C1F79647AB79593D
                                                                                                                                                                                                                          SHA-512:4047A7AD5F248F0B304FEF06C73EA655D603C39B6AC74629A2ADD49A93E74B23F458DC70E8150AD3F5BBF773F2387907B4BB69A95EB945B9FA432CA6B8AB173D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Baku) {. {-9223372036854775808 11964 0 LMT}. {-1441163964 10800 0 +03}. {-405140400 14400 0 +04}. {354916800 18000 1 +04}. {370724400 14400 0 +04}. {386452800 18000 1 +04}. {402260400 14400 0 +04}. {417988800 18000 1 +04}. {433796400 14400 0 +04}. {449611200 18000 1 +04}. {465343200 14400 0 +04}. {481068000 18000 1 +04}. {496792800 14400 0 +04}. {512517600 18000 1 +04}. {528242400 14400 0 +04}. {543967200 18000 1 +04}. {559692000 14400 0 +04}. {575416800 18000 1 +04}. {591141600 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 10800 0 +03}. {670374000 14400 1 +03}. {686098800 10800 0 +03}. {701823600 14400 1 +03}. {717548400 14400 0 +04}. {820440000 14400 0 +04}. {828234000 18000 1 +05}. {846378000 14400 0 +04}. {852062400 14400 0 +04}. {859680000 18000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.863210418273511
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKELYOUXGm2OHB+kevXZKmrROpDvFFsQ+8EXVeVSYvC:SlSWB9X52wKELPm2OHxePZ3FO1Rb+UVe
                                                                                                                                                                                                                          MD5:8291C9916E9D5E5C78DE38257798799D
                                                                                                                                                                                                                          SHA1:F67A474337CF5FF8460911C7003930455AA0C530
                                                                                                                                                                                                                          SHA-256:ED9D1C47D50461D312C7314D5C1403703E29EE14E6BAC97625EFB06F38E4942C
                                                                                                                                                                                                                          SHA-512:9B552812A0001271980F87C270EF4149201403B911826BDF17F66EE1015B9AC859C1B2E7BB4EB6BC56E37CDB24097BF001201C34AD7D4C0C910AE17CFEC36C8B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bangkok) {. {-9223372036854775808 24124 0 LMT}. {-2840164924 24124 0 BMT}. {-1570084924 25200 0 +07}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2044
                                                                                                                                                                                                                          Entropy (8bit):3.6106776173203916
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5Mi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/L7UVtrBju6waUwcTLTTg:9jFRRCfQuiB7TQZ
                                                                                                                                                                                                                          MD5:DC7A71DAB17C7F4A348DC1EE2FC458C5
                                                                                                                                                                                                                          SHA1:982FAB93A637D18A049DDBE96B0341736C66561D
                                                                                                                                                                                                                          SHA-256:52DB3278189AA2380D84A81199A2E7F3B40E9706228D2291C6257FD513D78667
                                                                                                                                                                                                                          SHA-512:90659D37D2A2E8574A88FD7F222C28D9572A9866FC3459B0CC1760FECBC7C4A0574B224C252877D723B06DD72165C4FE368D5B00DAB662B85D2E0F4CB2A89271
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Barnaul) {. {-9223372036854775808 20100 0 LMT}. {-1579844100 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {780433200 2
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7754
                                                                                                                                                                                                                          Entropy (8bit):3.6329631010207892
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OnQv8iPC28v82K/w1VxDmsCZgV+f7dIWDkLDo1WlqCTpXxcKvjRQZwtPEWRTvS4y:OQjPCL5VxKWC7dIWDkLDoqphsX
                                                                                                                                                                                                                          MD5:2D3AE4AD36BD5F302F980EB5F1DD0E4A
                                                                                                                                                                                                                          SHA1:02244056D6D4EC57937D1E187CC65E8FD18F67F0
                                                                                                                                                                                                                          SHA-256:E9DD371FA47F8EF1BE04109F0FD3EBD9FC5E2B0A12C0630CDD20099C838CBEBB
                                                                                                                                                                                                                          SHA-512:2E4528254102210B8A9A2263A8A8E72774D40F57C2431C2DD6B1761CD91FB6CEA1FAD23877E1E2D86217609882F3605D7FE477B771A398F91F8D8AD3EAF90BAC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Beirut) {. {-9223372036854775808 8520 0 LMT}. {-2840149320 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1473645600 10800 1 EEST}. {-1460948400 7200 0 EET}. {-399866400 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336794400 10800 1 EEST}. {-323578800 7200 0 EET}. {-305172000 10800 1 EEST}. {-291956400 7200 0 EET}. {-273636000 10800 1 EEST}. {-260420400 7200 0 EET}. {78012000 10800 1 EEST}. {86734800 7200 0 EET}. {105055200 10800 1 EEST}. {118270800 7200 0 EET}. {136591200 10800 1 EEST}. {149806800 7200 0 EET}. {168127200 10800 1 EEST}. {181342800 7200 0 EET}. {199749600 10800 1 EEST}. {212965200 7200 0 EET}. {231285600 10800 1 EEST}. {244501200 7200 0 EE
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1611
                                                                                                                                                                                                                          Entropy (8bit):3.653654369590701
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQge4/SsOXEFCMiq90DIgb5j6gMJR/4TJTXSATolS+WSP7VSzlBSkhFSblDSDOQy:5qFqq9iTVrX2ioerAYabcivcnXKh
                                                                                                                                                                                                                          MD5:1A3A4825B73F11024FD21F94AE85F9D2
                                                                                                                                                                                                                          SHA1:E63443CC267B43EFEFFD1E3161293217526E7DC8
                                                                                                                                                                                                                          SHA-256:D8205F34BB8B618E2F8B4EB6E613BE1B5CFBBF3B6CBFAFE868644E1A1648C164
                                                                                                                                                                                                                          SHA-512:5C766BD6FB6195BEBD7CDF703B7E0A67FBB2BCF98052866AE9ACDC5B90469421508F52C60F22542BBA6ED8CC59B4889F20DB131B183918592139B6D135BC57A2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Bishkek) {. {-9223372036854775808 17904 0 LMT}. {-1441169904 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 18000 0 +05}. {670366800 21600 1 +05}. {683586000 18000 0 +05}. {703018800 21600 1 +05}. {717530400 18000 0 +05}. {734468400 21600 1 +05}. {748980000 18000 0 +05}. {765918000 21600 1 +05}. {780429600 18000 0 +05}. {797367600 2
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.792958708451203
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKXeAMMkEXGm2OHCQdvVVvUWUOVFW/FvOVSSC/FiUMWfV1S:SlSWB9X52wK0bm2OHCIvVVXUuW/MVSSV
                                                                                                                                                                                                                          MD5:95EE0EFC01271C3E3195ADC360F832C7
                                                                                                                                                                                                                          SHA1:CDFA243F359AC5D2FA22032BF296169C8B2B942A
                                                                                                                                                                                                                          SHA-256:241C47769C689823961D308B38D8282F6852BC0511E7DC196BF6BF4CFADBE401
                                                                                                                                                                                                                          SHA-512:11CAE9804EF933A790F5B9B86CC03C133DBD1DB97FAA78F508D681662AAC3714B93166B596F248799FC5B86344B48764865D3371427119999CB02963C98E15C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Brunei) {. {-9223372036854775808 27580 0 LMT}. {-1383464380 27000 0 +0730}. {-1167636600 28800 0 +08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.721946029615065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq864DdVAIgN1EF2WFKh0s+WFKvvn:SlSWB9IZaM3ya4DdVAIgo2wKN+wKvv
                                                                                                                                                                                                                          MD5:A967F010A398CD98871E1FF97F3E48AC
                                                                                                                                                                                                                          SHA1:6C8C0AF614D6789CD1F9B6243D26FAC1F9B767EF
                                                                                                                                                                                                                          SHA-256:B07250CD907CA11FE1C94F1DCCC999CECF8E9969F74442A9FCC00FC48EDE468B
                                                                                                                                                                                                                          SHA-512:67E3207C8A63A5D8A1B7ED1A62D57639D695F9CD83126EB58A70EF076B816EC5C4FDBD23F1F32A4BB6F0F9131D30AF16B56CD92B1C42C240FD886C81BA8940DA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kolkata)]} {. LoadTimeZoneFile Asia/Kolkata.}.set TZData(:Asia/Calcutta) $TZData(:Asia/Kolkata).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2014
                                                                                                                                                                                                                          Entropy (8bit):3.6060921590827193
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQyeCXQS6oziDpiKXtyiyzilUBinUijiRziiiaSiYzYWk2HgQiMhNIziPiRikiAF:5c/9InX4n7m84nPIzOtfjQhGTNw
                                                                                                                                                                                                                          MD5:A3FB98DC18AC53AE13337F3CC1C4CE68
                                                                                                                                                                                                                          SHA1:F0280D5598AEB6B6851A8C2831D4370E27121B5F
                                                                                                                                                                                                                          SHA-256:D0A984F2EDB6A5A4E3C3CFA812550782F6B34AD0C79B1DD742712EBA14B7B9FB
                                                                                                                                                                                                                          SHA-512:A33E2E0EA093BB758539A761B4CF82204699BC35950ACD329DA9205A141469930CAF179E4331DF505408C7C4F97480416DC16C7E93E53B12392509E5A093E562
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Chita) {. {-9223372036854775808 27232 0 LMT}. {-1579419232 28800 0 +08}. {-1247558400 32400 0 +10}. {354898800 36000 1 +10}. {370706400 32400 0 +09}. {386434800 36000 1 +10}. {402242400 32400 0 +09}. {417970800 36000 1 +10}. {433778400 32400 0 +09}. {449593200 36000 1 +10}. {465325200 32400 0 +09}. {481050000 36000 1 +10}. {496774800 32400 0 +09}. {512499600 36000 1 +10}. {528224400 32400 0 +09}. {543949200 36000 1 +10}. {559674000 32400 0 +09}. {575398800 36000 1 +10}. {591123600 32400 0 +09}. {606848400 36000 1 +10}. {622573200 32400 0 +09}. {638298000 36000 1 +10}. {654627600 32400 0 +09}. {670352400 28800 0 +09}. {670356000 32400 1 +09}. {686080800 28800 0 +08}. {695757600 32400 0 +10}. {701802000 36000 1 +10}. {717526800 32400 0 +09}. {733251600 36000 1 +10}. {748976400 32400 0 +09}. {764701200 36000 1 +10}. {780426000 324
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1563
                                                                                                                                                                                                                          Entropy (8bit):3.6863846285633057
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQtZeCjXN1xJq4tyiIHil++lqivEoziHvqil+fiRBiS/BvWjiY2Vizi6Xi4+k8ih:5tFdXJVHpkbvvWr2sv5kPYxwM3N5
                                                                                                                                                                                                                          MD5:799F0221A1834C723E6BBA2D00727156
                                                                                                                                                                                                                          SHA1:569BBC1F20F7157ECF753A8DEB49156B260A96E0
                                                                                                                                                                                                                          SHA-256:02FF47A619BE154A88530BA8C83F5D52277FA8E8F7941C0D33F89161CE1B5503
                                                                                                                                                                                                                          SHA-512:535812754A92E251A9C86C20E3032A6B363F77F6839C95DAD6ED18200ACAA3075E602AD626F50B84EB931D1D33BD0E00CA5AE1D1D95DEBECDE57EE9E65A137DF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Choibalsan) {. {-9223372036854775808 27480 0 LMT}. {-2032933080 25200 0 +07}. {252435600 28800 0 +08}. {417974400 36000 0 +09}. {433778400 32400 0 +09}. {449593200 36000 1 +09}. {465314400 32400 0 +09}. {481042800 36000 1 +09}. {496764000 32400 0 +09}. {512492400 36000 1 +09}. {528213600 32400 0 +09}. {543942000 36000 1 +09}. {559663200 32400 0 +09}. {575391600 36000 1 +09}. {591112800 32400 0 +09}. {606841200 36000 1 +09}. {622562400 32400 0 +09}. {638290800 36000 1 +09}. {654616800 32400 0 +09}. {670345200 36000 1 +09}. {686066400 32400 0 +09}. {701794800 36000 1 +09}. {717516000 32400 0 +09}. {733244400 36000 1 +09}. {748965600 32400 0 +09}. {764694000 36000 1 +09}. {780415200 32400 0 +09}. {796143600 36000 1 +09}. {811864800 32400 0 +09}. {828198000 36000 1 +09}. {843919200 32400 0 +09}. {859647600 36000 1 +09}. {875368800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.815975603028152
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFKh2V7/4WFKdv:SlSWB9IZaM3yMwVAIgE2wKho4wKt
                                                                                                                                                                                                                          MD5:37D7B7C1E435E2539FDD83D71149DD9A
                                                                                                                                                                                                                          SHA1:F4ADE88DDF244BD2FF5B23714BF7449A74907E08
                                                                                                                                                                                                                          SHA-256:78611E8A0EBEBC4CA2A55611FAC1F00F8495CB044B2A6462214494C7D1F5DA6A
                                                                                                                                                                                                                          SHA-512:E0C57229DC76746C6424606E41E10E97F0F08DD2B00659172DA35F3444BF48B4BC7E2F339A10ECC21628A683E2CB8B4FA5945B8AC68C6BAFEA720AFBB88C90C6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Chongqing) $TZData(:Asia/Shanghai).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.840543487466552
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFK7LeL9J4WFKdv:SlSWB9IZaM3yMwVAIgE2wK7LUT4wKt
                                                                                                                                                                                                                          MD5:6F21100628DD48B2FF4B1F2AF92E05CB
                                                                                                                                                                                                                          SHA1:B74478D0EC95A577C2A58497692DB293BBD31586
                                                                                                                                                                                                                          SHA-256:DB2C572E039D1A777FFC66558E2BEE46C52D8FE57401436AE18BB4D5892131CE
                                                                                                                                                                                                                          SHA-512:2D3C37790B6A764FE4E1B8BD8EDF1D073D711F59CEA3EC5E6003E481898F7285B42A14E904C3D148422244BB083FBA42C6623DF7DA05923F6145EEE3FD259520
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Chungking) $TZData(:Asia/Shanghai).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356
                                                                                                                                                                                                                          Entropy (8bit):4.4006537789533695
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKr+tJm2OHgPZv9tGZjSWV/FSQRpPUrK/F/ND/k5iRVVFSQ9R/U4C/k:MBp52z+mdHgPZvqZj1NjDPh/F/1/Y4vF
                                                                                                                                                                                                                          MD5:4074FBEF7DD0DF48AD74BDAED3106A75
                                                                                                                                                                                                                          SHA1:FB1E5190EAF8BF9B64EED49F115E34926C1EAF53
                                                                                                                                                                                                                          SHA-256:DB6A7EA0DC757706126114BED5E693565938AABFE3DA1670170647CCDE6BE6CD
                                                                                                                                                                                                                          SHA-512:A469C09FA6A1DA1DB140BFFECB931DBC4B2315A13B82FCA8813C93954598D03818323B7DDE1106D1F1D815ED69523361369AF883CA4818CA562D728F7A88D8A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Colombo) {. {-9223372036854775808 19164 0 LMT}. {-2840159964 19172 0 MMT}. {-2019705572 19800 0 +0530}. {-883287000 21600 1 +06}. {-862639200 23400 1 +0630}. {-764051400 19800 0 +0530}. {832962600 23400 0 +0630}. {846266400 21600 0 +06}. {1145039400 19800 0 +0530}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):164
                                                                                                                                                                                                                          Entropy (8bit):4.733855608307331
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8ntdVAIgN6Ko2WFK1S2WFKwu:SlSWB9IZaM3yHtdVAIgMKo2wKM2wKwu
                                                                                                                                                                                                                          MD5:629FC03B52D24615FB052C84B0F30452
                                                                                                                                                                                                                          SHA1:80D24B1A70FC568AB9C555BD1CC70C17571F6061
                                                                                                                                                                                                                          SHA-256:BD3E4EE002AFF8F84E74A6D53E08AF5B5F2CAF2B06C9E70B64B05FC8F0B6CA99
                                                                                                                                                                                                                          SHA-512:1C912A5F323E84A82D60300F6AC55892F870974D4DEFE0AF0B8F6A87867A176D3F8D66C1A5B11D8560F549D738FFE377DC20EB055182615062D4649BBA011F32
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dhaka)]} {. LoadTimeZoneFile Asia/Dhaka.}.set TZData(:Asia/Dacca) $TZData(:Asia/Dhaka).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8031
                                                                                                                                                                                                                          Entropy (8bit):3.629699951300869
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:zY75F5VoNVIkbl3IUQZufk0Eej4YWuM0c5/61a7/VGfV8SbU5J3Mirmgs3LmiK:zI75KN+YlgYE+4YWPB6O4in9
                                                                                                                                                                                                                          MD5:202E5950F6324878B0E6FD0056D2F186
                                                                                                                                                                                                                          SHA1:A668D4DC3E73A292728CCE136EFFAC95D5952A81
                                                                                                                                                                                                                          SHA-256:3BB43B71FF807AA3BF6A7F94680FB8BD586A1471218307A6A7A4CE73A5A3A55E
                                                                                                                                                                                                                          SHA-512:5F9A7308E9C08267ECB8D502505EF9B32269D62FA490D6BC01F6927CB8D5B40CA17BB0CDFA3EE78D48C7686EAA7FD266666EB80E54125859F86CADFD7366DB6B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Damascus) {. {-9223372036854775808 8712 0 LMT}. {-1577931912 7200 0 EET}. {-1568592000 10800 1 EEST}. {-1554080400 7200 0 EET}. {-1537142400 10800 1 EEST}. {-1522630800 7200 0 EET}. {-1505692800 10800 1 EEST}. {-1491181200 7200 0 EET}. {-1474243200 10800 1 EEST}. {-1459126800 7200 0 EET}. {-242265600 10800 1 EEST}. {-228877200 7200 0 EET}. {-210556800 10800 1 EEST}. {-197427600 7200 0 EET}. {-178934400 10800 1 EEST}. {-165718800 7200 0 EET}. {-147398400 10800 1 EEST}. {-134269200 7200 0 EET}. {-116467200 10800 1 EEST}. {-102646800 7200 0 EET}. {-84326400 10800 1 EEST}. {-71110800 7200 0 EET}. {-52704000 10800 1 EEST}. {-39488400 7200 0 EET}. {-21168000 10800 1 EEST}. {-7952400 7200 0 EET}. {10368000 10800 1 EEST}. {23583600 7200 0 EET}. {41904000 10800 1 EEST}. {55119600 7200 0 EET}. {73526400 10800 1 EEST}. {86742000 7200 0 EET}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):351
                                                                                                                                                                                                                          Entropy (8bit):4.345019966462698
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKwfTm2OHEmVFnP9vX+H7UlckVVFSQRL/FG/UPy/UiF/ji/UiF/jWKO:MBp52YfTmdHzdP9P+bcvjRQmmF/j2F/8
                                                                                                                                                                                                                          MD5:F5A6B4C90D50208EF512A728A2A03BB6
                                                                                                                                                                                                                          SHA1:C9D3C712EDABDFCD1629E72AF363CEB2A0E2334E
                                                                                                                                                                                                                          SHA-256:42BF62F13C2F808BEFD2601D668AFE5D49EA417FC1AC5391631C20ED7225FF46
                                                                                                                                                                                                                          SHA-512:64D413D9299436877F287943FF454EB2AFD415D87DE13AACA50E7BD123828D16CFABD679677F36C891024AB53C62695559DAABDECCC127A669C3ECA0F155453B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dhaka) {. {-9223372036854775808 21700 0 LMT}. {-2524543300 21200 0 HMT}. {-891582800 23400 0 +0630}. {-872058600 19800 0 +0530}. {-862637400 23400 0 +0630}. {-576138600 21600 0 +06}. {1230746400 21600 0 +06}. {1245430800 25200 1 +06}. {1262278800 21600 0 +06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):226
                                                                                                                                                                                                                          Entropy (8bit):4.536797249025477
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKCXeLm2OHnBGeVmkNvyvScCVUkP1avScCC:MBp52qXEmdHnBvVDVyHCPP8HCC
                                                                                                                                                                                                                          MD5:54EC6A256F6D636CD98DD48CDF0E48F1
                                                                                                                                                                                                                          SHA1:571244C3D84A8A6EFFE55C787BFBCE7A6014462C
                                                                                                                                                                                                                          SHA-256:88D61A495724F72DA6AB20CC997575F27797589C7B80F2C63C27F84BF1EB8D61
                                                                                                                                                                                                                          SHA-512:EDD67865D3AD3D2F6D1AFFAE35B6B25E2439164E0BEF8E0E819F88F937F896C10EAB513467524DA0A5A2E3D4C78F55EA3F98F25979B8625DFC66801CBBE9301F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dili) {. {-9223372036854775808 30140 0 LMT}. {-1830414140 28800 0 +08}. {-879152400 32400 0 +09}. {199897200 28800 0 +08}. {969120000 32400 0 +09}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):142
                                                                                                                                                                                                                          Entropy (8bit):4.927936359970315
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKQiXGm2OHvkdvUQK23NVsRYvC:SlSWB9X52wKQZm2OHvsRVNSQC
                                                                                                                                                                                                                          MD5:6CC252314EDA586C514C76E6981EEAEE
                                                                                                                                                                                                                          SHA1:F58C9072FBBA31C735345162F629BB6CAAB9C871
                                                                                                                                                                                                                          SHA-256:8D7409EBC94A817962C3512E07AFF32838B54B939068129C73EBBEEF8F858ED2
                                                                                                                                                                                                                          SHA-512:40BC04B25F16247F9F6569A37D28EDCA1D7FB33586482A990A36B5B148BF7598CF5493D38C4D1CBDF664553302E4D6505D80EB7E7B5B9FB5141CB7F39B99A93D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dubai) {. {-9223372036854775808 13272 0 LMT}. {-1577936472 14400 0 +04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):791
                                                                                                                                                                                                                          Entropy (8bit):3.8859952964866946
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQJeOJSsOXEFCMiq90DIgb5j6gMJR/4TJTi4GDL:51Fqq9iTVuzL
                                                                                                                                                                                                                          MD5:316F527821D632517866A6E7F97365B3
                                                                                                                                                                                                                          SHA1:6F56985AF44E6533778CFB1FC04D206367A6C0BF
                                                                                                                                                                                                                          SHA-256:5A8FFD24FF0E26C99536EB9D3FB308C28B3491042034B187140039B7A5DF6F1F
                                                                                                                                                                                                                          SHA-512:7EA1ABD02CD8461DD91576B5BCB46B6E3AE25F94BC7936DC051C0964F4EA2F55C58CB1FA6C3A82334AAAAFCDBD6D6DBEBE33FB1C7C45FBDCA5EC43FD46A970A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Dushanbe) {. {-9223372036854775808 16512 0 LMT}. {-1441168512 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 21600 1 +06}. {684363600 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7341
                                                                                                                                                                                                                          Entropy (8bit):3.6266031318601386
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:vPByq7VKviW/naKl9pUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:vPFi//Th2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:997FF37AE5C6E2E13664100C2FBF8E19
                                                                                                                                                                                                                          SHA1:BF59628212564E50BCC5247C534658C8B7CFF0EE
                                                                                                                                                                                                                          SHA-256:639F26A411E298948A4FAC560E218ED7079722FB4E4AAF8CE0688A3BE24868AE
                                                                                                                                                                                                                          SHA-512:41FEF2026A3062ECA62729A555D10F9ABA777CCBE4E907489B74FC91C645E6010ECFABD2ACB4ED652ADF97E0A69935CB2FADA6732744ED3ADA95DD2EB3C08655
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Famagusta) {. {-9223372036854775808 8148 0 LMT}. {-1518920148 7200 0 EET}. {166572000 10800 1 EEST}. {182293200 7200 0 EET}. {200959200 10800 1 EEST}. {213829200 7200 0 EET}. {228866400 10800 1 EEST}. {243982800 7200 0 EET}. {260316000 10800 1 EEST}. {276123600 7200 0 EET}. {291765600 10800 1 EEST}. {307486800 7200 0 EET}. {323820000 10800 1 EEST}. {338936400 7200 0 EET}. {354664800 10800 1 EEST}. {370386000 7200 0 EET}. {386114400 10800 1 EEST}. {401835600 7200 0 EET}. {417564000 10800 1 EEST}. {433285200 7200 0 EET}. {449013600 10800 1 EEST}. {465339600 7200 0 EET}. {481068000 10800 1 EEST}. {496789200 7200 0 EET}. {512517600 10800 1 EEST}. {528238800 7200 0 EET}. {543967200 10800 1 EEST}. {559688400 7200 0 EET}. {575416800 10800 1 EEST}. {591138000 7200 0 EET}. {606866400 10800 1 EEST}. {622587600 7200 0 EET}. {638316000 108
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7974
                                                                                                                                                                                                                          Entropy (8bit):3.660638074803316
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:uR7CUoVy0FUeLR2S5nfclzdVYi8x6PxGtv2h4WSwLnRPCILXwuiaAXOH4g1iWThA:uRiVy0WetivMKRPCAXwZ6plyk8B
                                                                                                                                                                                                                          MD5:45C8B6CB180839A1F3D500071D1AFC1D
                                                                                                                                                                                                                          SHA1:59E900FB2D7BFF44AED578B9BD10AA0530B4F5D1
                                                                                                                                                                                                                          SHA-256:FA459622B54CD0A5603323EA00CE64D63BBC957EC0BDCC9BE73D48916237619C
                                                                                                                                                                                                                          SHA-512:5F485299D6DF9EBD620D2AEF7BDE21C7505EAD51467699874408691C644E9E6D8C63DD6061489E924B95672A227B5B9921E4281405981FCBBCA4619F80195AB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Gaza) {. {-9223372036854775808 8272 0 LMT}. {-2185409872 7200 0 EEST}. {-933645600 10800 1 EEST}. {-857358000 7200 0 EEST}. {-844300800 10800 1 EEST}. {-825822000 7200 0 EEST}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EEST}. {-779853600 10800 1 EEST}. {-762656400 7200 0 EEST}. {-748310400 10800 1 EEST}. {-731127600 7200 0 EEST}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.814799933523261
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtA2WFKwHp4WFKdv:SlSWB9IZaM3yMwVAIgE2wKi4wKt
                                                                                                                                                                                                                          MD5:2B286E58F2214F7A28D2A678B905CFA3
                                                                                                                                                                                                                          SHA1:A76B2D8BA2EA264FE84C5C1ED3A6D3E13288132F
                                                                                                                                                                                                                          SHA-256:6917C89A78ED54DD0C5C9968E5149D42727A9299723EC1D2EBD531A65AD37227
                                                                                                                                                                                                                          SHA-512:0022B48003FE9C8722FD1762FFB8E07E731661900FCE40BD6FE82B70F162FF5D32888028519D51682863ADCAC6DD21D35634CA06489FD4B704DA5A8A018BF26F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:Asia/Harbin) $TZData(:Asia/Shanghai).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7950
                                                                                                                                                                                                                          Entropy (8bit):3.6634483349947593
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JrCUoVy0FUeLR2S5nfclzdVYi8x6PxGtv2h4WFwLnRPCILXwuiaAXOH4g1iWThiD:JyVy0WetivMvRPCAXwZ6plyk8B
                                                                                                                                                                                                                          MD5:67602731E9D02418D0B1DCBCB9367870
                                                                                                                                                                                                                          SHA1:13D896B6B8B553879D70BFBA6734AFDFE3A522A4
                                                                                                                                                                                                                          SHA-256:9D89F879C6F47F05015C8B7D66639AAC8AF2D5A6F733CDA60CFF22EB0EB71221
                                                                                                                                                                                                                          SHA-512:ECA8EB42144EF4097E606AC57795491248D02C331CE426E7C23D42490F873CD19924F1C2318E2FF1D18E275F3CAD60E9DFBB08B4B8334EA3FF1EE31452B9E167
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hebron) {. {-9223372036854775808 8423 0 LMT}. {-2185410023 7200 0 EEST}. {-933645600 10800 1 EEST}. {-857358000 7200 0 EEST}. {-844300800 10800 1 EEST}. {-825822000 7200 0 EEST}. {-812685600 10800 1 EEST}. {-794199600 7200 0 EEST}. {-779853600 10800 1 EEST}. {-762656400 7200 0 EEST}. {-748310400 10800 1 EEST}. {-731127600 7200 0 EEST}. {-682653600 7200 0 EET}. {-399088800 10800 1 EEST}. {-386650800 7200 0 EET}. {-368330400 10800 1 EEST}. {-355114800 7200 0 EET}. {-336790800 10800 1 EEST}. {-323654400 7200 0 EET}. {-305168400 10800 1 EEST}. {-292032000 7200 0 EET}. {-273632400 10800 1 EEST}. {-260496000 7200 0 EET}. {-242096400 10800 1 EEST}. {-228960000 7200 0 EET}. {-210560400 10800 1 EEST}. {-197424000 7200 0 EET}. {-178938000 10800 1 EEST}. {-165801600 7200 0 EET}. {-147402000 10800 1 EEST}. {-134265600 7200 0 EET}. {-115866000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):381
                                                                                                                                                                                                                          Entropy (8bit):4.352557338100764
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKKACm2OHAT1P3XTxYCMVSYv/lTkd+zvScCBcFVtQvMVSYv/vMUEkB5:MBp52SmdHqP3tYZF/Cd+zHCBiVikF/v9
                                                                                                                                                                                                                          MD5:41EF18FF071B8541A5CA830C131B22D3
                                                                                                                                                                                                                          SHA1:65E502FD93FE025FD7B358B2953335F4B41BBC68
                                                                                                                                                                                                                          SHA-256:95525205BC65B8DB626EF5257F6C3A93A4902AB6415C080EE67399B41D9AD7AA
                                                                                                                                                                                                                          SHA-512:3889199D84CE456CC7231B0A81CCA7F4C976ED13015869BF486078075F24687C588F9FB52E09744ED4763CA71CC869048C588CDD42C2EA195A9B04EB9C18A123
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ho_Chi_Minh) {. {-9223372036854775808 25600 0 LMT}. {-2004073600 25590 0 PLMT}. {-1851577590 25200 0 +07}. {-852105600 28800 0 +08}. {-782643600 32400 0 +09}. {-767869200 25200 0 +07}. {-718095600 28800 0 +08}. {-457776000 25200 0 +07}. {-315648000 28800 0 +08}. {171820800 25200 0 +07}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2150
                                                                                                                                                                                                                          Entropy (8bit):3.923186571913929
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQPeCtKkjz1lk/mJURqMJDHxyOPq8vWhV0Z8dX83FdX1BzX4JX/v9YsKP2ieGklq:5tK+Zlim0nltdT1BD45X+iA3tnN7
                                                                                                                                                                                                                          MD5:BBA59A5886F48DCEC5CEFDB689D36880
                                                                                                                                                                                                                          SHA1:8207DE6AB5F7EC6077506ED3AE2EEA3AB35C5FAE
                                                                                                                                                                                                                          SHA-256:F66F0F161B55571CC52167427C050327D4DB98AD58C6589FF908603CD53447F0
                                                                                                                                                                                                                          SHA-512:D071D97E6773FC22ABCCE3C8BE133E0FDA40C385234FEB23F69C84ABB9042E319D6891BD9CA65F2E0A048E6F374DB91E8880DCD9711A86B79A3A058517A3DBFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hong_Kong) {. {-9223372036854775808 27402 0 LMT}. {-2056693002 28800 0 HKT}. {-907389000 32400 1 HKST}. {-891667800 28800 0 HKT}. {-884246400 32400 0 JST}. {-766746000 28800 0 HKT}. {-747981000 32400 1 HKST}. {-728544600 28800 0 HKT}. {-717049800 32400 1 HKST}. {-694503000 28800 0 HKT}. {-683785800 32400 1 HKST}. {-668064600 28800 0 HKT}. {-654755400 32400 1 HKST}. {-636615000 28800 0 HKT}. {-623305800 32400 1 HKST}. {-605165400 28800 0 HKT}. {-591856200 32400 1 HKST}. {-573715800 28800 0 HKT}. {-559801800 32400 1 HKST}. {-542352600 28800 0 HKT}. {-528352200 32400 1 HKST}. {-510211800 28800 0 HKT}. {-498112200 32400 1 HKST}. {-478762200 28800 0 HKT}. {-466662600 32400 1 HKST}. {-446707800 28800 0 HKT}. {-435213000 32400 1 HKST}. {-415258200 28800 0 HKT}. {-403158600 32400 1 HKST}. {-383808600 28800 0 HKT}. {-371709000 32400 1 HKST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1528
                                                                                                                                                                                                                          Entropy (8bit):3.661748285763298
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQxEecP9NQwOkN/DN9yinNQHhNY0NVgN8wNy7nNA8eZN0vNb7NBN5pNUckNBe/v9:5MjQwJ/pMiNQXYGVy8iy7NA8ev0VbxX3
                                                                                                                                                                                                                          MD5:6CF9D198D7CC1F0E16DDFE91A6B4A1A5
                                                                                                                                                                                                                          SHA1:D1DEE309E479271CDC3A306272CF4D94367EC68A
                                                                                                                                                                                                                          SHA-256:7E189D7937E5B41CD94AB5208E40C645BE678F2A4F4B02EE1305595E5296E3D0
                                                                                                                                                                                                                          SHA-512:56488F1DD1C694457FC7F8B13550B3D2B3BC737241E311783135115E2BD585FDD083A5146488A121BC02CC1F05EF40C05A88EED1AF391FB9E4653C1F25CC4AF7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Hovd) {. {-9223372036854775808 21996 0 LMT}. {-2032927596 21600 0 +06}. {252439200 25200 0 +07}. {417978000 28800 1 +07}. {433785600 25200 0 +07}. {449600400 28800 1 +07}. {465321600 25200 0 +07}. {481050000 28800 1 +07}. {496771200 25200 0 +07}. {512499600 28800 1 +07}. {528220800 25200 0 +07}. {543949200 28800 1 +07}. {559670400 25200 0 +07}. {575398800 28800 1 +07}. {591120000 25200 0 +07}. {606848400 28800 1 +07}. {622569600 25200 0 +07}. {638298000 28800 1 +07}. {654624000 25200 0 +07}. {670352400 28800 1 +07}. {686073600 25200 0 +07}. {701802000 28800 1 +07}. {717523200 25200 0 +07}. {733251600 28800 1 +07}. {748972800 25200 0 +07}. {764701200 28800 1 +07}. {780422400 25200 0 +07}. {796150800 28800 1 +07}. {811872000 25200 0 +07}. {828205200 28800 1 +07}. {843926400 25200 0 +07}. {859654800 28800 1 +07}. {875376000 25200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2017
                                                                                                                                                                                                                          Entropy (8bit):3.6386982097761646
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5ykBJaTcSANEWiLwyyzLyonofMQa3go8h8PNhRHbsb0k4xiRhIsJ2sbA:BB656ofU5ARdN8
                                                                                                                                                                                                                          MD5:E4995DD6F78F859B17952F15DB554ADC
                                                                                                                                                                                                                          SHA1:19D4957E2A8CC17BCA7F020E4DF411F0E3AC8B49
                                                                                                                                                                                                                          SHA-256:122FEB27760CC2CD714531CF68E6C77F8505E9CA11A147DDA649E2C98E150494
                                                                                                                                                                                                                          SHA-512:A36B334E72C9D0854F0DE040EEEBF7B92E537F770D4EEBB1697AB9DD6AB00E678BE58A7CE2514A4667BA2B8760625C22D21AFE3AB80C5B1DBB7C10E91CDDDB3A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Irkutsk) {. {-9223372036854775808 25025 0 LMT}. {-2840165825 25025 0 IMT}. {-1575874625 25200 0 +07}. {-1247554800 28800 0 +09}. {354902400 32400 1 +09}. {370710000 28800 0 +08}. {386438400 32400 1 +09}. {402246000 28800 0 +08}. {417974400 32400 1 +09}. {433782000 28800 0 +08}. {449596800 32400 1 +09}. {465328800 28800 0 +08}. {481053600 32400 1 +09}. {496778400 28800 0 +08}. {512503200 32400 1 +09}. {528228000 28800 0 +08}. {543952800 32400 1 +09}. {559677600 28800 0 +08}. {575402400 32400 1 +09}. {591127200 28800 0 +08}. {606852000 32400 1 +09}. {622576800 28800 0 +08}. {638301600 32400 1 +09}. {654631200 28800 0 +08}. {670356000 25200 0 +08}. {670359600 28800 1 +08}. {686084400 25200 0 +07}. {695761200 28800 0 +09}. {701805600 32400 1 +09}. {717530400 28800 0 +08}. {733255200 32400 1 +09}. {748980000 28800 0 +08}. {764704800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.853387718159342
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHt2WFK4HB/8QaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHt2wK4HJ
                                                                                                                                                                                                                          MD5:7EC8D7D32DC13BE15122D8E26C55F9A2
                                                                                                                                                                                                                          SHA1:5B07C7161F236DF34B0FA83007ECD75B6435F420
                                                                                                                                                                                                                          SHA-256:434B8D0E3034656B3E1561615CCA192EFA62942F285CD59338313710900DB6CB
                                                                                                                                                                                                                          SHA-512:D8F1999AF509871C0A7184CFEFB0A50C174ABDE218330D9CDC784C7599A655AD55F6F2173096EA91EE5700B978B9A94BBFCA41970206E7ADEB804D0EE03B45ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Asia/Istanbul) $TZData(:Europe/Istanbul).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):357
                                                                                                                                                                                                                          Entropy (8bit):4.4086954127843585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKcr6m2OHATJesaSY4SMNkc5q/MVSSmWSyvScCAdMVSSo1CkDF4mMVt:MBp52E6mdHjkAc5aMxdSyHCQMxoRDF4d
                                                                                                                                                                                                                          MD5:88C82B18565C27E050074AD02536D257
                                                                                                                                                                                                                          SHA1:9A150FCD9FAA0E903D70A719D949D00D82F531E3
                                                                                                                                                                                                                          SHA-256:BC07AE610EF38F63EFF384E0815F6F64E79C61297F1C21469B2C5F19679CEAFB
                                                                                                                                                                                                                          SHA-512:29152E0359BC0FB8648BC959DE01D0BCCD17EB928AE000FF77958E7F00FF7D65BFD2C740B438E114D53ABA260B7855B2695EF7C0484850A77FFF34F7A0B255CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jakarta) {. {-9223372036854775808 25632 0 LMT}. {-3231299232 25632 0 BMT}. {-1451719200 26400 0 +0720}. {-1172906400 27000 0 +0730}. {-876641400 32400 0 +09}. {-766054800 27000 0 +0730}. {-683883000 28800 0 +08}. {-620812800 27000 0 +0730}. {-189415800 25200 0 WIB}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):205
                                                                                                                                                                                                                          Entropy (8bit):4.7830039894710366
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKcjm2OHG4YVkcfvScCvowkVcrd1CV4zvhL:MBp52omdHNYacfHCvop2BMVkV
                                                                                                                                                                                                                          MD5:3C073BD9DFD2C4F9BC95C8A94652FF5D
                                                                                                                                                                                                                          SHA1:F4084CDFC025B3A21092DE18DD8ECAFCA5F0EBBB
                                                                                                                                                                                                                          SHA-256:82FC06E73477EBB50C894244C91E613BF3551053359798F42F2F2C913730A470
                                                                                                                                                                                                                          SHA-512:7E79E4425A0D855AAE8DCF5C7196AABE8E75D92CD9B65C61B82B31B29395D4A5F2D8B1E90454037753D03A1BDDE44E8F15D7E999E65C49BE8E8F8A2B2C4EECD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jayapura) {. {-9223372036854775808 33768 0 LMT}. {-1172913768 32400 0 +09}. {-799491600 34200 0 +0930}. {-189423000 32400 0 WIT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7690
                                                                                                                                                                                                                          Entropy (8bit):3.684387169764595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:GzmnxfFtWR8fKnG/QvW+tCE5nfclzdVYi8x6PxGtv2TiGuyLsbAicBnKqXRGlGrz:0mKivDivbOKWKwX5BrAZp0
                                                                                                                                                                                                                          MD5:4C37DF27AB1E906CC624A62288847BA8
                                                                                                                                                                                                                          SHA1:BE690D3958A4A6722ABDF047BF22ACEC8B6D6AFE
                                                                                                                                                                                                                          SHA-256:F10DF7378FF71EDA45E8B1C007A280BBD4629972D12EAB0C6BA7623E98AAFA17
                                                                                                                                                                                                                          SHA-512:B14F5FB330078A564796114FA6804EA12CE0AD6B2DF6D871FF6E7B416425B12FFD6B4E8511FCD55609FBCE95C8EDFF1E14B1C8C505F4B5B66F47EA52FD53F307
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Jerusalem) {. {-9223372036854775808 8454 0 LMT}. {-2840149254 8440 0 JMT}. {-1641003640 7200 0 IST}. {-933645600 10800 1 IDT}. {-857358000 7200 0 IST}. {-844300800 10800 1 IDT}. {-825822000 7200 0 IST}. {-812685600 10800 1 IDT}. {-794199600 7200 0 IST}. {-779853600 10800 1 IDT}. {-762656400 7200 0 IST}. {-748310400 10800 1 IDT}. {-731127600 7200 0 IST}. {-681962400 14400 1 IDDT}. {-673243200 10800 1 IDT}. {-667962000 7200 0 IST}. {-652327200 10800 1 IDT}. {-636426000 7200 0 IST}. {-622087200 10800 1 IDT}. {-608947200 7200 0 IST}. {-591847200 10800 1 IDT}. {-572486400 7200 0 IST}. {-558576000 10800 1 IDT}. {-542851200 7200 0 IST}. {-527731200 10800 1 IDT}. {-514425600 7200 0 IST}. {-490845600 10800 1 IDT}. {-482986800 7200 0 IST}. {-459475200 10800 1 IDT}. {-451537200 7200 0 IST}. {-428551200 10800 1 IDT}. {-418262400 7200 0 IST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.804360783547797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKTwkXGm2OHodFxsYvXgVHURRNVsRYvFFqdj/cXHFOVRWh:SlSWB9X52wKTEm2OHoH+YPgVHURbSQF9
                                                                                                                                                                                                                          MD5:9A8CCA0B4337CB6FA15BF1A4F01F6C22
                                                                                                                                                                                                                          SHA1:A4C72FC1EF6EEBDBB5C8C698BCB298DFB5061726
                                                                                                                                                                                                                          SHA-256:4F266D90C413FA44DFCA5BE13E45C00428C694AC662CB06F2451CC3FF08E080F
                                                                                                                                                                                                                          SHA-512:E8074AA0D8B15EE33D279C97A01FF69451A99C7711FFD66B3E9B6B6B021DE957A63F6B747C7A63E3F3C1241E0A2687D81E780D6B54228EE6B7EB9040D7F06A60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kabul) {. {-9223372036854775808 16608 0 LMT}. {-2524538208 14400 0 +04}. {-788932800 16200 0 +0430}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1989
                                                                                                                                                                                                                          Entropy (8bit):3.6993158455985338
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ+3e8/HklxL7/Fpd2kNNxLcULBQdHl2yYvpQ62itgUiRrn5d6kGFF6UERWkBUHA:5c/HezFvpchKvW62XPdXJMwT3Lea
                                                                                                                                                                                                                          MD5:496BD39D36218DF67279DA8DE9C7457B
                                                                                                                                                                                                                          SHA1:8AE6E5CF7E1E693D11A112B75A0D24A135E94487
                                                                                                                                                                                                                          SHA-256:6B757333C12F2BFE782258D7E9126ECE0E62696EF9C24B2955A791145D6780E9
                                                                                                                                                                                                                          SHA-512:BADBF7893825F6C7053A23A7AA11B45A2EDBECC4580695BB6B8E568B7FFE5ED72BF61019F3CB6D7B8E663ACAF099F26E266450EC03F3C6B2F8E34BA0D12D100A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kamchatka) {. {-9223372036854775808 38076 0 LMT}. {-1487759676 39600 0 +11}. {-1247569200 43200 0 +13}. {354888000 46800 1 +13}. {370695600 43200 0 +12}. {386424000 46800 1 +13}. {402231600 43200 0 +12}. {417960000 46800 1 +13}. {433767600 43200 0 +12}. {449582400 46800 1 +13}. {465314400 43200 0 +12}. {481039200 46800 1 +13}. {496764000 43200 0 +12}. {512488800 46800 1 +13}. {528213600 43200 0 +12}. {543938400 46800 1 +13}. {559663200 43200 0 +12}. {575388000 46800 1 +13}. {591112800 43200 0 +12}. {606837600 46800 1 +13}. {622562400 43200 0 +12}. {638287200 46800 1 +13}. {654616800 43200 0 +12}. {670341600 39600 0 +12}. {670345200 43200 1 +12}. {686070000 39600 0 +11}. {695746800 43200 0 +13}. {701791200 46800 1 +13}. {717516000 43200 0 +12}. {733240800 46800 1 +13}. {748965600 43200 0 +12}. {764690400 46800 1 +13}. {780415200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):441
                                                                                                                                                                                                                          Entropy (8bit):4.32891547054552
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52SmdH35S6DvjRQ+vjjEn6S7Pictk6a2iW6oNl:cQSe3pjRQ+jjE6S7lTh
                                                                                                                                                                                                                          MD5:7A7CFCB7273FCAE33F77048F225BBBBD
                                                                                                                                                                                                                          SHA1:44701B91CBC61FCAC8EEB6E67BCCA0403E9FDD7E
                                                                                                                                                                                                                          SHA-256:9F8C46E5AC4DF691DDCB13C853660915C94316E73F74DD36AF889D5137F1761B
                                                                                                                                                                                                                          SHA-512:44D5A0656032D61152C98B92E3ACA88197A73D87E2D0E8853D6A0E430BDF9290D3B718F9E5864840A6FFA59CDC0D4D47BCEE0471F176E62A05C1083CB35BEBB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Karachi) {. {-9223372036854775808 16092 0 LMT}. {-1988166492 19800 0 +0530}. {-862637400 23400 1 +0630}. {-764145000 19800 0 +0530}. {-576135000 18000 0 +05}. {38775600 18000 0 PKT}. {1018119600 21600 1 PKST}. {1033840800 18000 0 PKT}. {1212260400 21600 1 PKST}. {1225476000 18000 0 PKT}. {1239735600 21600 1 PKST}. {1257012000 18000 0 PKT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):169
                                                                                                                                                                                                                          Entropy (8bit):4.920527043039276
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8s4YkdVAIgNrMvN2WFKu3e2WFKjvn:SlSWB9IZaM3yMGdVAIgWvN2wKulwKjvn
                                                                                                                                                                                                                          MD5:9A66108527388564A9FBDB87D586105F
                                                                                                                                                                                                                          SHA1:945E043A3CC45A4654C2D745A48E1D15F80A3CB5
                                                                                                                                                                                                                          SHA-256:E2965AF4328FB065A82E8A21FF342C29A5942C2EDD304CE1C9087A23A91B65E1
                                                                                                                                                                                                                          SHA-512:C3985D972AFB27E194CBE117E6CF8C45AA5A1B6504133FF85D52E8024387133D11F9EE7238FF87DC1D96F140B9467E6DB3F99B0B98299E6782A643288ABD3308
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Urumqi)]} {. LoadTimeZoneFile Asia/Urumqi.}.set TZData(:Asia/Kashgar) $TZData(:Asia/Urumqi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.8475287330512495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKXIi7mFSXGm2OHF+VT5vUQKwMTXvv6QzFrRk8P4VvWVQC:SlSWB9X52wKYgyJm2OH0T5RNMzvSQhR5
                                                                                                                                                                                                                          MD5:FEFB0E2021110BC9175AC505536BDE12
                                                                                                                                                                                                                          SHA1:8366110D91C7EA929DB300871DDC70808D458F90
                                                                                                                                                                                                                          SHA-256:C4E46CE4385C676F5D7AC4B123C42F153F7B3F3E9F434698E8D56E1907A9B7C9
                                                                                                                                                                                                                          SHA-512:F8F9EE0B8648154B3E3BEF192C58F2415475422BED139F20FD3D3EF253E8137CBB39AB769704AB1F20EE03B398402BC5B4A3E55BE284D1785F347B951FECEF62
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kathmandu) {. {-9223372036854775808 20476 0 LMT}. {-1577943676 19800 0 +0530}. {504901800 20700 0 +0545}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.786408960928606
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8yIi7VyVAIgN1AIilHt2WFKSiZ1/2WFKXIi7v:SlSWB9IZaM3y7gVyVAIg5M2wKSg1/2wm
                                                                                                                                                                                                                          MD5:A30FEA461B22B2CB3A67A616E3AE08FD
                                                                                                                                                                                                                          SHA1:F368B215E15F6F518AEBC92289EE703DCAE849A1
                                                                                                                                                                                                                          SHA-256:1E2A1569FE432CDA75C64FA55E24CA6F938C1C72C15FBB280D5B04F6C5E9AD69
                                                                                                                                                                                                                          SHA-512:4F3D0681791C23EF19AFF239D2932D2CE1C991406F6DC8E313C083B5E03D806D26337ED2477700596D9A9F4FB1B7FC4A551F897A2A88CB7253CC7F863E586F03
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Kathmandu)]} {. LoadTimeZoneFile Asia/Kathmandu.}.set TZData(:Asia/Katmandu) $TZData(:Asia/Kathmandu).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2046
                                                                                                                                                                                                                          Entropy (8bit):3.6162520408317844
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQNobe1I6oziDpiKXtyiyzilUBinUijiRziiiaSiYzYWk2HgQiMhNIziPiRikiA/:5NoV9InX4n7m84nPIzOtVEChbmAPD6
                                                                                                                                                                                                                          MD5:0AB1CB51373021D2929AD3BB6A6A7B36
                                                                                                                                                                                                                          SHA1:6A58A13DE2479D7C07DA574A2850DB5479F42106
                                                                                                                                                                                                                          SHA-256:7C282AFCBC654495AD174C5679C0FDA9C65DED557389648F924E809E337DF6A5
                                                                                                                                                                                                                          SHA-512:E865073DF7273319ADE90C0520D843C636679ACFF1FEEC4C62B85AB7458393A71EAAE32F507D90863BE4018212B497E41EFC7EA684DF821A0D4FF1A9895FDCD8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Khandyga) {. {-9223372036854775808 32533 0 LMT}. {-1579424533 28800 0 +08}. {-1247558400 32400 0 +10}. {354898800 36000 1 +10}. {370706400 32400 0 +09}. {386434800 36000 1 +10}. {402242400 32400 0 +09}. {417970800 36000 1 +10}. {433778400 32400 0 +09}. {449593200 36000 1 +10}. {465325200 32400 0 +09}. {481050000 36000 1 +10}. {496774800 32400 0 +09}. {512499600 36000 1 +10}. {528224400 32400 0 +09}. {543949200 36000 1 +10}. {559674000 32400 0 +09}. {575398800 36000 1 +10}. {591123600 32400 0 +09}. {606848400 36000 1 +10}. {622573200 32400 0 +09}. {638298000 36000 1 +10}. {654627600 32400 0 +09}. {670352400 28800 0 +09}. {670356000 32400 1 +09}. {686080800 28800 0 +08}. {695757600 32400 0 +10}. {701802000 36000 1 +10}. {717526800 32400 0 +09}. {733251600 36000 1 +10}. {748976400 32400 0 +09}. {764701200 36000 1 +10}. {780426000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):324
                                                                                                                                                                                                                          Entropy (8bit):4.554598325373998
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKvCm2OHEX3gYLXdUvvVQLpUFGZjSVVFJGTNsR/tckVVFJGTL/FG/+d:MBp523CmdHNYjWXVQtUEZjAJGJs55vJg
                                                                                                                                                                                                                          MD5:FABB53074E1D767952C664BBA02E8975
                                                                                                                                                                                                                          SHA1:36D2D438FEEBF585D7A0B546647C08B63A582EA1
                                                                                                                                                                                                                          SHA-256:DAB02F68D5EEA0DAC6A2BBB7D12930E1B4DA62EBAEC7DE35C0AA55F72CCFF139
                                                                                                                                                                                                                          SHA-512:E178779CE31F8D16DFEC5F71F228BCB05FDA1939B1BCE204C40B14904682283BDC99F27B662E3995EEEE607D0E8C70BE3CE3DF6EAD355399566CF360D5EC9E70
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kolkata) {. {-9223372036854775808 21208 0 LMT}. {-3645237208 21200 0 HMT}. {-3155694800 19270 0 MMT}. {-2019705670 19800 0 IST}. {-891581400 23400 1 +0630}. {-872058600 19800 0 IST}. {-862637400 23400 1 +0630}. {-764145000 19800 0 IST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1991
                                                                                                                                                                                                                          Entropy (8bit):3.6170298534050245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5Mi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/LIcy9zU9Muq2PIX/9sC/:hjFRRCfQucXsNN0On
                                                                                                                                                                                                                          MD5:83333A0E3E9810621A8BADA29B04F256
                                                                                                                                                                                                                          SHA1:CDC375C93E7F3019562DE7CE1D9EE2776FE7FE9E
                                                                                                                                                                                                                          SHA-256:00A9E8DDDC4314F7271F7490001ABD29B6F5EAEB9080645911FF5DA8BD7F671C
                                                                                                                                                                                                                          SHA-512:08913E002C7D3D54F0E09029C70A0F2D18636F6F52B12F10593BECF732F40E180780D4C6127E0A3B321EAF54AF660A48E8C3E29A161B6ED6E0E46C06BBD309D6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Krasnoyarsk) {. {-9223372036854775808 22286 0 LMT}. {-1577513486 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {7804332
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):362
                                                                                                                                                                                                                          Entropy (8bit):4.404454529095857
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wK1NLm2OHrPmdXiWOb/MVSYv/1MesF5X8dSMd0dMVSSm8kvScCvCIMY:MBp52PLmdHrPdDTMF/wFZMxcHClMxi
                                                                                                                                                                                                                          MD5:B5FC8D431304F5C1ADF7D0B237DA5A52
                                                                                                                                                                                                                          SHA1:79FC3057CD88E4DF71421AD52C34E0127FBD6FDA
                                                                                                                                                                                                                          SHA-256:138912D754FBA8A1306063CCE897218972A4B0976EDDEC5C8E69A7965B0CD198
                                                                                                                                                                                                                          SHA-512:27DC64B43958814E1A935D817CCFE7ADE8E6E6A778E27E391683FC491764EB77774A3D4A871C4E83BBA43FF8BA2383CBB8CC2D4F1FEB1AE063735C95651865E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuala_Lumpur) {. {-9223372036854775808 24406 0 LMT}. {-2177477206 24925 0 SMT}. {-2038200925 25200 0 +07}. {-1167634800 26400 1 +0720}. {-1073028000 26400 0 +0720}. {-894180000 27000 0 +0730}. {-879665400 32400 0 +09}. {-767005200 27000 0 +0730}. {378664200 28800 0 +08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):646
                                                                                                                                                                                                                          Entropy (8bit):3.99554344665026
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52HLKmdHXXUBMxoWFMcDBMxkT9r5N2Xhf7JSX3lzHC3:cQHLKeHUzaMcDBkkN5N2XV7Ja3hi3
                                                                                                                                                                                                                          MD5:2F27D1377C9EBBACDC260A50C195BDBB
                                                                                                                                                                                                                          SHA1:397B8714F2C909A8EB88A7A1F4A1AEA0A5B8E80E
                                                                                                                                                                                                                          SHA-256:519FDD455107270E6F8F3848C214D3D44CC1465B7B3E375318857D4A9093E1C0
                                                                                                                                                                                                                          SHA-512:E4583E6C3FEB5ADAD41827D8ADCD7DA34CCB92D2B62B9D7C3D59F76719B9EE2FE44697CFD00943D9E2A4DBAEB929C97A1FF520FFF62EB6829C88D71EC8C51993
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Kuching) {. {-9223372036854775808 26480 0 LMT}. {-1383463280 27000 0 +0730}. {-1167636600 28800 0 +08}. {-1082448000 30000 1 +08}. {-1074586800 28800 0 +08}. {-1050825600 30000 1 +08}. {-1042964400 28800 0 +08}. {-1019289600 30000 1 +08}. {-1011428400 28800 0 +08}. {-987753600 30000 1 +08}. {-979892400 28800 0 +08}. {-956217600 30000 1 +08}. {-948356400 28800 0 +08}. {-924595200 30000 1 +08}. {-916734000 28800 0 +08}. {-893059200 30000 1 +08}. {-885198000 28800 0 +08}. {-879667200 32400 0 +09}. {-767005200 28800 0 +08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):168
                                                                                                                                                                                                                          Entropy (8bit):4.82804794783422
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8t1zVAIgNsM1E2WFKdQWFK81S:SlSWB9IZaM3yN1zVAIgaM1E2wKdQwK8c
                                                                                                                                                                                                                          MD5:6D6109F6EC1E12881C60EC44AAEB772B
                                                                                                                                                                                                                          SHA1:B5531BEAC1C07DA57A901D0A48F4E1AC03F07467
                                                                                                                                                                                                                          SHA-256:67BB9F159C752C744AC6AB26BBC0688CF4FA94C58C23B2B49B871CAA8774FC5D
                                                                                                                                                                                                                          SHA-512:B0624B9F936E5C1392B7EBB3190D7E97EAE96647AB965BB9BE045D2C3082B1C7E48FF89A7B57FD3475D018574E7294D45B068C555A43AAEDFD65AC5C5C5D0A5B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Riyadh)]} {. LoadTimeZoneFile Asia/Riyadh.}.set TZData(:Asia/Kuwait) $TZData(:Asia/Riyadh).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):164
                                                                                                                                                                                                                          Entropy (8bit):4.729350272507574
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8PpVAIgNz5YF2WFKf+WFKjn:SlSWB9IZaM3yxVAIgLYF2wKGwKjn
                                                                                                                                                                                                                          MD5:DB6155900D4556EE7B3089860AD5C4E3
                                                                                                                                                                                                                          SHA1:708E4AE427C8BAF589509F4330C389EE55C1D514
                                                                                                                                                                                                                          SHA-256:8264648CF1EA3E352E13482DE2ACE70B97FD37FBB1F28F70011561CFCBF533EA
                                                                                                                                                                                                                          SHA-512:941D52208FABB634BABCD602CD468F2235199813F4C1C5AB82A453E8C4CE4543C1CE3CBDB9D035DB039CFFDBC94D5D0F9D29363442E2458426BDD52ECDF7C3C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Macau)]} {. LoadTimeZoneFile Asia/Macau.}.set TZData(:Asia/Macao) $TZData(:Asia/Macau).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2141
                                                                                                                                                                                                                          Entropy (8bit):3.8815104664173843
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5o89px1D/MG/B/j/gf/d/iM/MW/C/2/Y/yf/9/y/l/v1EG/vFw/veE/K/Z/D/U/h:/p7DD5L2lRkWqOA6fVKdXqGXFwXeECRK
                                                                                                                                                                                                                          MD5:DC20959BDB02CF86A33CE2C82D4D9853
                                                                                                                                                                                                                          SHA1:90FC1820FA0E3B1C4BD2158185F95DCD1AA271D6
                                                                                                                                                                                                                          SHA-256:6263F011537DB5CAF6B09F16D55DADE527A475AEE04F1BA38A75D13E9D125355
                                                                                                                                                                                                                          SHA-512:8C6D0FA9584595B93A563D60387520CE9B28595C2C3880004275BAE66313A7606379646D27FB5EB91EC8D96D3B23959E2F9E3ABC97C203FD76E1DCC5ABB64374
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Macau) {. {-9223372036854775808 27250 0 LMT}. {-2056692850 28800 0 CST}. {-884509200 32400 0 +09}. {-873280800 36000 1 +09}. {-855918000 32400 0 +09}. {-841744800 36000 1 +09}. {-828529200 32400 0 +10}. {-765363600 28800 0 CT}. {-747046800 32400 1 CDT}. {-733827600 28800 0 CST}. {-716461200 32400 1 CDT}. {-697021200 28800 0 CST}. {-683715600 32400 1 CDT}. {-667990800 28800 0 CST}. {-654771600 32400 1 CDT}. {-636627600 28800 0 CST}. {-623322000 32400 1 CDT}. {-605178000 28800 0 CST}. {-591872400 32400 1 CDT}. {-573642000 28800 0 CST}. {-559818000 32400 1 CDT}. {-541674000 28800 0 CST}. {-528368400 32400 1 CDT}. {-510224400 28800 0 CST}. {-498128400 32400 1 CDT}. {-478774800 28800 0 CST}. {-466678800 32400 1 CDT}. {-446720400 28800 0 CST}. {-435229200 32400 1 CDT}. {-415258200 28800 0 CST}. {-403158600 32400 1 CDT}. {-383808600 2880
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2016
                                                                                                                                                                                                                          Entropy (8bit):3.6746770806664517
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQmecGdvBOCdwdVdptQvMCTP2rF1gCzlODU9xE305r/CXVWWHs/gSNkna:5tvBHwRw/P2rFGAlODU9PZUEWQgmka
                                                                                                                                                                                                                          MD5:18E80309362762B7757629B51F28AF99
                                                                                                                                                                                                                          SHA1:502C70F24251BC062785A9349E6204CB719BF932
                                                                                                                                                                                                                          SHA-256:6493D629E3CD4DB555A547F942BCCB4FFC7BBF7298FFBF9503F6DE3177ADBAC9
                                                                                                                                                                                                                          SHA-512:C477E0DCF4E78E57E075FB5CAA45E70D4864EDFC40EAC2DD43D80F71408836E5BD468B15EB34B95020F2DB6CE531D67F076EF8EED4833ADEC1F6D37B2200CC84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Magadan) {. {-9223372036854775808 36192 0 LMT}. {-1441188192 36000 0 +10}. {-1247565600 39600 0 +12}. {354891600 43200 1 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {780418800 3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):234
                                                                                                                                                                                                                          Entropy (8bit):4.682322181661182
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKCm2OHUVRYQTLQTvUfkc3gEkNHkH8vScCxWv:MBp526mdHsrTD8cQJl7HCMv
                                                                                                                                                                                                                          MD5:87D843314195847B6E4117119A1F701C
                                                                                                                                                                                                                          SHA1:E51DC3A0BF20B09D8745AC682B4869A031A0A515
                                                                                                                                                                                                                          SHA-256:22046165D40C8A553FE22A28E127514DF469E79581E0746101816A973456029D
                                                                                                                                                                                                                          SHA-512:D241803442876A59170C1A90ACC66DEAF169CBF9B8CD7DE964BEF02D222B1D07511E241D441C3DA6AE7A7D1AAC1F4EDB5A21655C2923A3807BBFA8630071BCE9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Makassar) {. {-9223372036854775808 28656 0 LMT}. {-1577951856 28656 0 MMT}. {-1172908656 28800 0 +08}. {-880272000 32400 0 +09}. {-766054800 28800 0 WITA}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):406
                                                                                                                                                                                                                          Entropy (8bit):4.4205762929520755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52G4JmdHnzZBPE6JwucQzX4rjJbmJtKn:cQG4Je11RbXzXqQ+
                                                                                                                                                                                                                          MD5:3A833BF91AFE7FABBA98D11F29D84EAA
                                                                                                                                                                                                                          SHA1:1622BEF54A12DE163B77309A0B7AF1C38AA6324B
                                                                                                                                                                                                                          SHA-256:665E07B7A01E8A9D04B76B74B2EA0D11BDFC0BE6CA855DFDDBB5F9A6C9A97E90
                                                                                                                                                                                                                          SHA-512:DFABB558CE2A8B96A976DD3B45B78CECE3633D51EE67F24E5AD59C7CF388538C5560EC133C60C3F0AFE8C68D88B1C05A12608A0408ACECBEEC38A84E3DC972FC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Manila) {. {-9223372036854775808 -57360 0 LMT}. {-3944621040 29040 0 LMT}. {-2229321840 28800 0 PST}. {-1046678400 32400 1 PDT}. {-1038733200 28800 0 PST}. {-873273600 32400 0 JST}. {-794221200 28800 0 PST}. {-496224000 32400 1 PDT}. {-489315600 28800 0 PST}. {259344000 32400 1 PDT}. {275151600 28800 0 PST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):165
                                                                                                                                                                                                                          Entropy (8bit):4.754394427749078
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8DhVAIgN6Sn62WFKvE+H+WFKQo:SlSWB9IZaM3yjhVAIgMS62wKLewKQo
                                                                                                                                                                                                                          MD5:5D8EBBC297A2258C352BC80535B7F7F1
                                                                                                                                                                                                                          SHA1:684CAF480AF5B8A98D9AD1A1ECD4E07434F36875
                                                                                                                                                                                                                          SHA-256:4709F2DA036EB96FB7B6CC40859BF59F1146FE8D3A7AFE326FBA3B8CB68049CE
                                                                                                                                                                                                                          SHA-512:FD67E920D3D5FE69AF35535A8BBD2791204C6B63050EFECC0857F24D393712C4BC4660EA0A350D2A4DDA144073413BE013D71D73E6F3638CA30480541F9731FA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Dubai)]} {. LoadTimeZoneFile Asia/Dubai.}.set TZData(:Asia/Muscat) $TZData(:Asia/Dubai).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7368
                                                                                                                                                                                                                          Entropy (8bit):3.620699686510499
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:EPByq7VKviW/naKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEA:EPFi//uh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:21EEEC6314C94D1476C2E79BBACFEB77
                                                                                                                                                                                                                          SHA1:2C9805CD01C84D446CBDB90B9542CB24CCDE4E39
                                                                                                                                                                                                                          SHA-256:7AAB1AC67D96287EE468608506868707B28FCD27A8F53128621801DCF0122162
                                                                                                                                                                                                                          SHA-512:D4B0A0E60B102E10E03CF5BD07C5783E908D5E7079B646177C57C30D67B44C114EFF4DCFC71AF8441D67BD5A351068FBFFD8C5E08F06F1D69946B3EA7D49FC2D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Nicosia) {. {-9223372036854775808 8008 0 LMT}. {-1518920008 7200 0 EET}. {166572000 10800 1 EEST}. {182293200 7200 0 EET}. {200959200 10800 1 EEST}. {213829200 7200 0 EET}. {228866400 10800 1 EEST}. {243982800 7200 0 EET}. {260316000 10800 1 EEST}. {276123600 7200 0 EET}. {291765600 10800 1 EEST}. {307486800 7200 0 EET}. {323820000 10800 1 EEST}. {338936400 7200 0 EET}. {354664800 10800 1 EEST}. {370386000 7200 0 EET}. {386114400 10800 1 EEST}. {401835600 7200 0 EET}. {417564000 10800 1 EEST}. {433285200 7200 0 EET}. {449013600 10800 1 EEST}. {465339600 7200 0 EET}. {481068000 10800 1 EEST}. {496789200 7200 0 EET}. {512517600 10800 1 EEST}. {528238800 7200 0 EET}. {543967200 10800 1 EEST}. {559688400 7200 0 EET}. {575416800 10800 1 EEST}. {591138000 7200 0 EET}. {606866400 10800 1 EEST}. {622587600 7200 0 EET}. {638316000 10800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1992
                                                                                                                                                                                                                          Entropy (8bit):3.626746433557725
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5qi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/LIcy9zU9Muq2PIX/9sCP:bjFRRCfQucXsNN0OX
                                                                                                                                                                                                                          MD5:11B80F2A9B7B090DD146BD97E9DB7D43
                                                                                                                                                                                                                          SHA1:4A2886799A50D031D79C935261B50363AA27768A
                                                                                                                                                                                                                          SHA-256:4018CE273BC4D02057F66A4715626F0E4D8C7050391C00BB5AE054B4DA8DE2F8
                                                                                                                                                                                                                          SHA-512:1F1650C1DBC3A171FF30C7657D7F99963A0C8D63B85460B45DE75AFABECE28F2A51236FB71DFF3EE567CC58E71B88623E4880DEBD18E9E9C9E527CF97D5FE926
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novokuznetsk) {. {-9223372036854775808 20928 0 LMT}. {-1441259328 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {780433
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2048
                                                                                                                                                                                                                          Entropy (8bit):3.623418616375595
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5HNi17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7F/zTXUVtrBju6waUwcTLTTWF:6jFRRCfQuozB7TQt
                                                                                                                                                                                                                          MD5:46E5FB7DEB8041BC9A2ADC83728944A7
                                                                                                                                                                                                                          SHA1:B5826E206EAA3E8789A0F9E4B7511CEBFD1B6764
                                                                                                                                                                                                                          SHA-256:C241F732B9731FA141B03FF1F990556C9BF14A1B21C9757C7FF75E688908B8A0
                                                                                                                                                                                                                          SHA-512:42B6BEEE9C15CB59C010013FE0673CB0DF46CD0AC388DF7D57DCCD54482C950F2935F8A8D7DC68CFFD184B698283589134901C9C597970D95C5B608CD160AF70
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Novosibirsk) {. {-9223372036854775808 19900 0 LMT}. {-1579476700 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {738090000 25200 0 +07}. {748987200 21600 0 +06}. {7647120
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1984
                                                                                                                                                                                                                          Entropy (8bit):3.5988580260925795
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5aQyvONnwqeDinDL+8kSViqS6A+VzTXUVtrBju6waUwcTLTTW59OxJCT:IkHdiq5BzB7TQJ
                                                                                                                                                                                                                          MD5:54E1F8C11C9CF4BF1DBCABF4AF31B7D4
                                                                                                                                                                                                                          SHA1:3C428E50A02941B19AF2A2F1EA02763AA2C1A846
                                                                                                                                                                                                                          SHA-256:5B9E95C813A184C969CC9808E136AD66C1231A55E66D4EE817BD2E85751C4EE9
                                                                                                                                                                                                                          SHA-512:83DBFCC089AC902609FFFCA8E675430B9BF1EA452626E83173F83317884B6AC2620CE8AA96488ACF13445D9D1D4776EB908232BD8205B8F4F9B034A68864C9A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Omsk) {. {-9223372036854775808 17610 0 LMT}. {-1582088010 18000 0 +05}. {-1247547600 21600 0 +07}. {354909600 25200 1 +07}. {370717200 21600 0 +06}. {386445600 25200 1 +07}. {402253200 21600 0 +06}. {417981600 25200 1 +07}. {433789200 21600 0 +06}. {449604000 25200 1 +07}. {465336000 21600 0 +06}. {481060800 25200 1 +07}. {496785600 21600 0 +06}. {512510400 25200 1 +07}. {528235200 21600 0 +06}. {543960000 25200 1 +07}. {559684800 21600 0 +06}. {575409600 25200 1 +07}. {591134400 21600 0 +06}. {606859200 25200 1 +07}. {622584000 21600 0 +06}. {638308800 25200 1 +07}. {654638400 21600 0 +06}. {670363200 18000 0 +06}. {670366800 21600 1 +06}. {686091600 18000 0 +05}. {695768400 21600 0 +07}. {701812800 25200 1 +07}. {717537600 21600 0 +06}. {733262400 25200 1 +07}. {748987200 21600 0 +06}. {764712000 25200 1 +07}. {780436800 2160
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1606
                                                                                                                                                                                                                          Entropy (8bit):3.6164715895962876
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ3eHykSYlS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDSVbt8i9E603CRWeZunSbOi:5FkXlkhs7bqIwIoMpqDPiBRBlL
                                                                                                                                                                                                                          MD5:38914E248C13912E33187496C5AD9691
                                                                                                                                                                                                                          SHA1:94C3711FC5EED22FE1929F2250208AC53DB175AC
                                                                                                                                                                                                                          SHA-256:581AF958787971BE487B37C2D2534E58FFA085AFD0D9F0E12E0EEFF03F476E53
                                                                                                                                                                                                                          SHA-512:8C7F21C8FCE2614181A998774E7038BAC483E502C3C31EDB0F4954E1424A0C16AD7DC5003E9533BB47CA2C06DD027E989BD696B2A74A23F686F74B8C9650BAE6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Oral) {. {-9223372036854775808 12324 0 LMT}. {-1441164324 10800 0 +03}. {-1247540400 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 18000 1 +04}. {686095200 14400 0 +04}. {701816400 14400 0 +04}. {701820000 18000 1 +04}. {717544800 14400 0 +04}. {733269600 18000 1 +04}. {748994400 14400 0 +04}. {764719200 1800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.911861786274714
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8VLYO5YFwVAIgN8ELYOAvN2WFKeHKLNM0WFKELYOun:SlSWB9IZaM3y1LewVAIgKELUvN2wKTNp
                                                                                                                                                                                                                          MD5:754059D3B44B7D60FB3BBFC97782C6CF
                                                                                                                                                                                                                          SHA1:6AE931805E6A42836D65E4EBC76A58BBFB3DCAF4
                                                                                                                                                                                                                          SHA-256:2C2DBD952FDA5CC042073B538C240B11C5C8E614DD4A697E1AA4C80E458575D0
                                                                                                                                                                                                                          SHA-512:B5AA4B51699EEAE0D9F91BBAB5B682BD84537C4E2CCE282613E1FFA1DDBE562CA487FB2F8CD006EE9DBC9EFAEFA587EC9998F0364E5C932CDB42C14319328D46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Bangkok)]} {. LoadTimeZoneFile Asia/Bangkok.}.set TZData(:Asia/Phnom_Penh) $TZData(:Asia/Bangkok).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):356
                                                                                                                                                                                                                          Entropy (8bit):4.428640713376822
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKT5wFJm2OHUed9xMkc5k/MVSSmCLkvScCAdMVSSo1CkDF4mMVSSmT+:MBp52L5wFJmdHFxbc5kMxvLkHCQMxoRg
                                                                                                                                                                                                                          MD5:81C643629BB417E38A5514BBEFEF55C8
                                                                                                                                                                                                                          SHA1:7D91E7F00A1A0B795EF3FDD1B3DD052EA2F6122C
                                                                                                                                                                                                                          SHA-256:998DFACE4BEE8A925E88D779D6C9FB9F9010BDB68010A9CCBC0B97BB5C49D452
                                                                                                                                                                                                                          SHA-512:1291521B74984EC03557C4DC492DB4DD1312626F61612C1F143BA482E2C32CD331647D86507D3B3721D148B2ED3CED6678123BD801DAA6B4F2D9A0C07B90575F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pontianak) {. {-9223372036854775808 26240 0 LMT}. {-1946186240 26240 0 PMT}. {-1172906240 27000 0 +0730}. {-881220600 32400 0 +09}. {-766054800 27000 0 +0730}. {-683883000 28800 0 +08}. {-620812800 27000 0 +0730}. {-189415800 28800 0 WITA}. {567964800 25200 0 WIB}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):263
                                                                                                                                                                                                                          Entropy (8bit):4.653238218910832
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wK8cE4Lm2OHnNdRw8vm1T0vGLucjv7:MBp520cEWmdHnNLvjuD
                                                                                                                                                                                                                          MD5:96754BB7D98975118E86B539D8F917B4
                                                                                                                                                                                                                          SHA1:5D366D64E08F1E9869EA2E93B5C6C5C0C5E7E3BE
                                                                                                                                                                                                                          SHA-256:10432381A63B2101A1218D357DA2075885F061F3A60BE00A32EED4DF868E5566
                                                                                                                                                                                                                          SHA-512:58BFFF63D40CF899304D69468949B806F00F5F2F2BE47040D5704E8C463D7B502725846933749172AF94CCD0AA894E30AD3154CC953D917AC8040B00D331124E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Pyongyang) {. {-9223372036854775808 30180 0 LMT}. {-1948782180 30600 0 KST}. {-1830414600 32400 0 JST}. {-768646800 32400 0 KST}. {1439564400 30600 0 KST}. {1525446000 32400 0 KST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):169
                                                                                                                                                                                                                          Entropy (8bit):4.800949065138005
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKK3vFSXGm2OHPFV4YvUQKb3VvVsRYvFF5FRVGsWYAvn:SlSWB9X52wKK3vTm2OHoYRcvSQFF5FR4
                                                                                                                                                                                                                          MD5:E70F65EBF35BE045F43456A67DEBCD34
                                                                                                                                                                                                                          SHA1:EE5669823D60518D0AAB07A7C539B8089807D589
                                                                                                                                                                                                                          SHA-256:B8E3F98A20BE938B9B1A6CE1CE4218751393B33E933A8F9278AA3EEECB13D2C6
                                                                                                                                                                                                                          SHA-512:9B142D27C92C2478ED086668F8E3DC4BD8E9FDA712D8888469816B4795B5DFDD7F5F22D7BA6A31CA4E32483ABE5A5B4C7CEFC91856B09DDF651E58867FC932C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qatar) {. {-9223372036854775808 12368 0 LMT}. {-1577935568 14400 0 +04}. {76190400 10800 0 +03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1583
                                                                                                                                                                                                                          Entropy (8bit):3.64822959139346
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5UXlkhs7bqIwIoMpqDS7oXbPw+bBijbbyzIr1jA:ICOgZbWM
                                                                                                                                                                                                                          MD5:E79902C294AEFC5A3A3DCFFF4142E54F
                                                                                                                                                                                                                          SHA1:8F9E8413C8F2D1DCF7DB74BE3AF067CBFEF2E73C
                                                                                                                                                                                                                          SHA-256:4A254C094E4F5955E33C19E01EF2B8D5B70AC0AD08203FD105F475C8F862F28C
                                                                                                                                                                                                                          SHA-512:3283248979FC76BE94D705013728FF206A32B8820D475C4DFC0636D2329E8FA5D251EAE5A21D9A9DC30659A6B567E73A7C614D7DA3F60025BFEA617ACE2EE597
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Qyzylorda) {. {-9223372036854775808 15712 0 LMT}. {-1441167712 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 14400 0 +04}. {670370400 18000 1 +04}. {701812800 18000 0 +05}. {701816400 21600 1 +05}. {717541200 18000 0 +05}. {733266000 21600 1 +05}. {748990800 18000 0 +05}. {764715600 21600 1 +05}. {780440400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):169
                                                                                                                                                                                                                          Entropy (8bit):4.761776859195572
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8nvwFVAIgNnEYO62WFK02KQMFfh4WFKsv:SlSWB9IZaM3yHvwFVAIgZ2wK0GEJ4wKO
                                                                                                                                                                                                                          MD5:6135C39675BB0F7BB94756F2057382CF
                                                                                                                                                                                                                          SHA1:EB2C51837E721776BED5F3F1F4A014BA29DA0282
                                                                                                                                                                                                                          SHA-256:E573ADFBB9935B7D0B56FAE699160226BF3416C50EB63D8EFEB1748C4B13BF91
                                                                                                                                                                                                                          SHA-512:BC1E7C9F1F64FF7D6A50E70E62566F385A923A475E309A321FCC03964350E427A4AEE801A20B3293A289AD67E03C86B59A674F91F34238068DA6C35BBB3B4307
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Yangon)]} {. LoadTimeZoneFile Asia/Yangon.}.set TZData(:Asia/Rangoon) $TZData(:Asia/Yangon).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):142
                                                                                                                                                                                                                          Entropy (8bit):4.928343799484186
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFK814tXGm2OHFukevSUi9VssWYAvn:SlSWB9X52wK81Hm2OHF7ePi9V1WYAv
                                                                                                                                                                                                                          MD5:76E7F746F8663772A350A2E2C2F680C7
                                                                                                                                                                                                                          SHA1:698E3C80122AC7B9E6EF7A45F87898334A1A622E
                                                                                                                                                                                                                          SHA-256:7D2FAC4F33EE0FA667AF8A2BF8257638A37CE0308038AC02C7B5BE6E1D1E5EDD
                                                                                                                                                                                                                          SHA-512:9B1C326D3B7C89957176540AB4F856780C57C495A44F80D998A4B0C5A10F358C2F727BF160FB49D17C104B4A8EB15AC5431CCB886AC59A92E56C964D757FA3B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Riyadh) {. {-9223372036854775808 11212 0 LMT}. {-719636812 10800 0 +03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.899371908380106
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8I65eVyVAIgN2h659Q2WFKwJ6h4WFK365ev:SlSWB9IZaM3yJAVyVAIgA4s2wKl4wKKK
                                                                                                                                                                                                                          MD5:A978C9AD6320DA94CB15324CA82C7417
                                                                                                                                                                                                                          SHA1:585C232F3FB2693C78C7831C1AF1DC25D6824CA7
                                                                                                                                                                                                                          SHA-256:73E1850BB0827043024EAFA1934190413CB36EA6FE18C90EA86B9DBC1D61EEBF
                                                                                                                                                                                                                          SHA-512:AE48BFB2A348CA992F2BCD6B1AF7495713B0526C326678309133D3271D90600624C096B4B8678AD7ECD19822E3BB24E27D12680FCA7FAA455D3CE324CE0B88ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ho_Chi_Minh)]} {. LoadTimeZoneFile Asia/Ho_Chi_Minh.}.set TZData(:Asia/Saigon) $TZData(:Asia/Ho_Chi_Minh).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2044
                                                                                                                                                                                                                          Entropy (8bit):3.636696819312369
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5i1fvBHwRw/P2rFGAlODU9HOUDEChbmAP+:gDtP2rUfDEZDV1ZP+
                                                                                                                                                                                                                          MD5:265EF8FD8FB07585726D3054289A1C48
                                                                                                                                                                                                                          SHA1:DDFB1197C7A7455674AA085A6B8089124EB47689
                                                                                                                                                                                                                          SHA-256:4CCF3795EF0EF42AA09A9225370E8E1537B53A0231363077DAC385F397208669
                                                                                                                                                                                                                          SHA-512:1ACE8C173E87530FCC809814DEA779CB09ED8A277DB3B0519E57727AD3A93F3AFAFAF0F80419A8B6A8FAC1B30600716169BEAE397E34E6BE1A18D0E31DB69B3F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Sakhalin) {. {-9223372036854775808 34248 0 LMT}. {-2031039048 32400 0 +09}. {-768560400 39600 0 +12}. {354891600 43200 1 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {780418800 3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):848
                                                                                                                                                                                                                          Entropy (8bit):3.8621003155318263
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQtleA7NSYlS7hhmSQcwqSlhJS9yiIoSBHrSLUSIYdDS7/S5c3oSATo6SSYL:5hXlkhs7bqIwIoMpqDS7oXjSpL
                                                                                                                                                                                                                          MD5:6E54D9946AC13DD77FDB8EA9C4FBD989
                                                                                                                                                                                                                          SHA1:EF0A4BFD84EC369CB9581D830F20193D73187C0B
                                                                                                                                                                                                                          SHA-256:28A76A0EAF55EEC9FE7BEFF3785FDEF8C3D93AAAA2E15EE37D861E73418AC9E4
                                                                                                                                                                                                                          SHA-512:15522A5B85DCD54DC0143A38799A870268D74C8A26FED44D50A55C536D3738905597AE4F3F2AB767DE73A7EDBAE8FBF467A6014E2001FA03924C3F39E0361F27
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Samarkand) {. {-9223372036854775808 16073 0 LMT}. {-1441168073 14400 0 +04}. {-1247544000 18000 0 +05}. {354913200 21600 1 +06}. {370720800 21600 0 +06}. {386445600 18000 0 +05}. {386449200 21600 1 +05}. {402256800 18000 0 +05}. {417985200 21600 1 +05}. {433792800 18000 0 +05}. {449607600 21600 1 +05}. {465339600 18000 0 +05}. {481064400 21600 1 +05}. {496789200 18000 0 +05}. {512514000 21600 1 +05}. {528238800 18000 0 +05}. {543963600 21600 1 +05}. {559688400 18000 0 +05}. {575413200 21600 1 +05}. {591138000 18000 0 +05}. {606862800 21600 1 +05}. {622587600 18000 0 +05}. {638312400 21600 1 +05}. {654642000 18000 0 +05}. {670366800 21600 1 +05}. {686091600 18000 0 +05}. {694206000 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):719
                                                                                                                                                                                                                          Entropy (8bit):4.129493275264732
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp525mdHjauvWz4aqceOcrIt04CaI8/HUYVfXzQD:cQ5edvWzJnJGIt047I8/Hp/zQD
                                                                                                                                                                                                                          MD5:7F24687F220D3B7F3C08A1F09F86BAEF
                                                                                                                                                                                                                          SHA1:2D96019AE5137935F7A43FCFD229645D656E21AF
                                                                                                                                                                                                                          SHA-256:8DBBFEEDD583DBE60E88E381D511B72DDD7AE93FEB64A2F97D6CDBF6B92A0775
                                                                                                                                                                                                                          SHA-512:BFD955BA4A284D91542D15CAE849C162D1470167D65365FF93B117D7B4361DB314ABEF5448CF5BA382002726D472FA74C3B9DD5B43CD539395FDC8241E4A0248
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Seoul) {. {-9223372036854775808 30472 0 LMT}. {-1948782472 30600 0 KST}. {-1830414600 32400 0 JST}. {-767350800 32400 0 KST}. {-498128400 30600 0 KST}. {-462702600 34200 1 KDT}. {-451733400 30600 0 KST}. {-429784200 34200 1 KDT}. {-418296600 30600 0 KST}. {-399544200 34200 1 KDT}. {-387451800 30600 0 KST}. {-368094600 34200 1 KDT}. {-356002200 30600 0 KST}. {-336645000 34200 1 KDT}. {-324552600 30600 0 KST}. {-305195400 34200 1 KDT}. {-293103000 30600 0 KST}. {-264933000 32400 0 KST}. {547578000 36000 1 KDT}. {560883600 32400 0 KST}. {579027600 36000 1 KDT}. {592333200 32400 0 KST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):887
                                                                                                                                                                                                                          Entropy (8bit):4.102844989906348
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ8emvZMwq/Zkq/fYFq/J2Lzq/9mBq/Qq/LPq/Rq/HTq/Pjq/rzq/c2q/uq/4u:5YvZMT/d/fYc/JWG/M4/z/W/o/G/PW/f
                                                                                                                                                                                                                          MD5:D3D88F264E5E44BAA890C19A4C87A24D
                                                                                                                                                                                                                          SHA1:BA2E3F8D69D1092CE925D40FE31BEABA0DC22905
                                                                                                                                                                                                                          SHA-256:90B585115252C37625B6BCDE14708AAE003E2D6F3408D8A9034ABB6FFFD66490
                                                                                                                                                                                                                          SHA-512:14485EEC4C77DA6D7DD813A84F3F5B0DE17AE06C23FBCDB20727376C62D675ED675893B8B9A4DAAA00C21B7550F83593780CA538DB05B4ADDD4604FBCD3B0E51
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Shanghai) {. {-9223372036854775808 29143 0 LMT}. {-2177481943 28800 0 CST}. {-933667200 32400 1 CDT}. {-922093200 28800 0 CST}. {-908870400 32400 1 CDT}. {-888829200 28800 0 CST}. {-881049600 32400 1 CDT}. {-767869200 28800 0 CST}. {-745833600 32400 1 CDT}. {-733827600 28800 0 CST}. {-716889600 32400 1 CDT}. {-699613200 28800 0 CST}. {-683884800 32400 1 CDT}. {-670669200 28800 0 CST}. {-652348800 32400 1 CDT}. {-650016000 28800 0 CST}. {515527200 32400 1 CDT}. {527014800 28800 0 CST}. {545162400 32400 1 CDT}. {558464400 28800 0 CST}. {577216800 32400 1 CDT}. {589914000 28800 0 CST}. {608666400 32400 1 CDT}. {621968400 28800 0 CST}. {640116000 32400 1 CDT}. {653418000 28800 0 CST}. {671565600 32400 1 CDT}. {684867600 28800 0 CST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):359
                                                                                                                                                                                                                          Entropy (8bit):4.370799489849578
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKfbdJm2OHxdPmIWOb/MVSYv/1MesF5X8dSMd0dMVSSm8kvScCvCIMY:MBp52nbdJmdHDPxDTMF/wFZMxcHClMxi
                                                                                                                                                                                                                          MD5:DFABB80419B69BE34B2FCD475CFDFE22
                                                                                                                                                                                                                          SHA1:2CF4F330E00397020328BCE28449B9F63E17067D
                                                                                                                                                                                                                          SHA-256:B251FBDB0DB4ACBB3855063C32681A5F32E609FA3AA0DDC43225D056D07CB2D3
                                                                                                                                                                                                                          SHA-512:EB362B7D0C5A4F1C605A8F2533A5CCAFCFA1F4D3B0F48C417CEA8C492834FE36822A75C726659786CBD4D5A544376D806E6BA8E952607997FBDDAF84E343B353
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Singapore) {. {-9223372036854775808 24925 0 LMT}. {-2177477725 24925 0 SMT}. {-2038200925 25200 0 +07}. {-1167634800 26400 1 +0720}. {-1073028000 26400 0 +0720}. {-894180000 27000 0 +0730}. {-879665400 32400 0 +09}. {-767005200 27000 0 +0730}. {378664200 28800 0 +08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1993
                                                                                                                                                                                                                          Entropy (8bit):3.7026922613316886
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQHOedtdvBOCdwdVdptQvMCTP2rF1gCzlODU9xE305r/CXVWWHs/gSNknK:5HxvBHwRw/P2rFGAlODU9PZUEWQgmkK
                                                                                                                                                                                                                          MD5:0F445767A84A429787070F7CCFB4D35B
                                                                                                                                                                                                                          SHA1:B524665DAC57E53A6D9A5386B5AEAAE52BD405A5
                                                                                                                                                                                                                          SHA-256:07F4857391E114D4B958C02B8FF72BEBCED72AA730F4F4B09F68F57349473503
                                                                                                                                                                                                                          SHA-512:8FE2AC4C1DCA60E597633377EF1F1C38EE027B7893DB77BA912F294B9B791B6762E62E87DAC17171B15629DD45BD7960D25ADAE96827DAB63FAA80E0956A8C80
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Srednekolymsk) {. {-9223372036854775808 36892 0 LMT}. {-1441188892 36000 0 +10}. {-1247565600 39600 0 +12}. {354891600 43200 1 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {78041
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1298
                                                                                                                                                                                                                          Entropy (8bit):3.983254382416919
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQXbe9Z+zuzq/9mBq/Qq/LPq/wO3q/uq/PC9q/hq/Rq/Gq/fq/Aq/Vtyq/fQH+zp:5XwoKG/M4/z/W/Ta/1/V/Y/o/d/y/D/t
                                                                                                                                                                                                                          MD5:16CF8E32D5B2933CE5A0F2F90B8090BA
                                                                                                                                                                                                                          SHA1:F899656FE3FDDD5F63B18D4800F909CD2DA6A151
                                                                                                                                                                                                                          SHA-256:E098A0A94ED53EC471841CDF6995AEF1F3A2699EDC143FF5DBDA7CB0AFD3FD6C
                                                                                                                                                                                                                          SHA-512:4856AC8AE2BB0C8856A87C5E46AD478E697AACB46B8679870FD581706802772D333FEA5D1D840BDDB1EAB3B4FDD46883CFD2EC4017F9E5C06CAF2A24539FA808
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Taipei) {. {-9223372036854775808 29160 0 LMT}. {-2335248360 28800 0 CST}. {-1017820800 32400 0 JST}. {-766224000 28800 0 CST}. {-745833600 32400 1 CDT}. {-733827600 28800 0 CST}. {-716889600 32400 1 CDT}. {-699613200 28800 0 CST}. {-683884800 32400 1 CDT}. {-670669200 28800 0 CST}. {-652348800 32400 1 CDT}. {-639133200 28800 0 CST}. {-620812800 32400 1 CDT}. {-607597200 28800 0 CST}. {-589276800 32400 1 CDT}. {-576061200 28800 0 CST}. {-562924800 32400 1 CDT}. {-541760400 28800 0 CST}. {-528710400 32400 1 CDT}. {-510224400 28800 0 CST}. {-497174400 32400 1 CDT}. {-478688400 28800 0 CST}. {-465638400 32400 1 CDT}. {-449830800 28800 0 CST}. {-434016000 32400 1 CDT}. {-418208400 28800 0 CST}. {-402480000 32400 1 CDT}. {-386672400 28800 0 CST}. {-370944000 32400 1 CDT}. {-355136400 28800 0 CST}. {-339408000 32400 1 CDT}. {-323600400 2
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):847
                                                                                                                                                                                                                          Entropy (8bit):3.8433853520749905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQZeQlNRSsOXEFCMiq90DIgb5j6gMJR/4TJTXSATo6SSYL:5HpFqq9iTVrXjSpL
                                                                                                                                                                                                                          MD5:24587E02A79D02973DE32E4CDACBE84C
                                                                                                                                                                                                                          SHA1:41B8CA1CAE10A9340359317EC8DD16C8637C0F1A
                                                                                                                                                                                                                          SHA-256:46C2D8E86BACFDB8280862AD9E28F7A0867740726EF21D08138C9F9A900CC1E9
                                                                                                                                                                                                                          SHA-512:07C939DCD5AB0DA3D3667D0D56421C6B40598C6DAB9641664E0ABB2CE4CC4562B10853C88DB51FBA5D1ED733E86193E88CE8984130FFF83955BD9335A59CF031
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tashkent) {. {-9223372036854775808 16631 0 LMT}. {-1441168631 18000 0 +05}. {-1247547600 21600 0 +06}. {354909600 25200 1 +06}. {370717200 21600 0 +06}. {386445600 25200 1 +06}. {402253200 21600 0 +06}. {417981600 25200 1 +06}. {433789200 21600 0 +06}. {449604000 25200 1 +06}. {465336000 21600 0 +06}. {481060800 25200 1 +06}. {496785600 21600 0 +06}. {512510400 25200 1 +06}. {528235200 21600 0 +06}. {543960000 25200 1 +06}. {559684800 21600 0 +06}. {575409600 25200 1 +06}. {591134400 21600 0 +06}. {606859200 25200 1 +06}. {622584000 21600 0 +06}. {638308800 25200 1 +06}. {654638400 21600 0 +06}. {670363200 18000 0 +05}. {670366800 21600 1 +05}. {686091600 18000 0 +05}. {694206000 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1669
                                                                                                                                                                                                                          Entropy (8bit):3.588597734517364
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQyGeHLQqpkb/cXXn8UDu5u8WmFeb/RLc9qENkw/ybt8i9E60339UyYU7s9UU7UT:5+YTVOZmF7N76eHj2QqzM
                                                                                                                                                                                                                          MD5:EEA5CEEDA499381B331676CF2D3B1189
                                                                                                                                                                                                                          SHA1:BC1D3871CC170F0BCBAE567C0D934CC131A7E410
                                                                                                                                                                                                                          SHA-256:260F3F9A9209170AC02961E881F02AA6D6C720BAACC29756CF1CC730FACCF662
                                                                                                                                                                                                                          SHA-512:0E8FF6B4EF0E102152B20D3C819F2673B6426B3D56DF42F89F44EB4467D0CA45F3D49B6564DA6FCB88BDB1887AF39382766F75FE3A3977CFB4408E06C6D1C062
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tbilisi) {. {-9223372036854775808 10751 0 LMT}. {-2840151551 10751 0 TBMT}. {-1441162751 10800 0 +03}. {-405140400 14400 0 +04}. {354916800 18000 1 +04}. {370724400 14400 0 +04}. {386452800 18000 1 +04}. {402260400 14400 0 +04}. {417988800 18000 1 +04}. {433796400 14400 0 +04}. {449611200 18000 1 +04}. {465343200 14400 0 +04}. {481068000 18000 1 +04}. {496792800 14400 0 +04}. {512517600 18000 1 +04}. {528242400 14400 0 +04}. {543967200 18000 1 +04}. {559692000 14400 0 +04}. {575416800 18000 1 +04}. {591141600 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 10800 0 +03}. {670374000 14400 1 +03}. {686098800 10800 0 +03}. {694213200 10800 0 +03}. {701816400 14400 1 +03}. {717537600 10800 0 +03}. {733266000 14400 1 +03}. {748987200 10800 0 +03}. {764715600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7021
                                                                                                                                                                                                                          Entropy (8bit):3.4346704245463338
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:BboVQCKYJ4cRvxoIDCMcuzf8mmU6gjilpM1Bdy6XaqYx7u0kLBT8U2nTEA4n8t/s:exqcFOIDCMcMrPqpIB8f9ZkF0EIk
                                                                                                                                                                                                                          MD5:E179D37382F44D866D495F5D38FD5D88
                                                                                                                                                                                                                          SHA1:35C5BFFE89795786B7ED0BB3B7822666D6BFCB5B
                                                                                                                                                                                                                          SHA-256:41F1DBB61094C00E2424E22780930258BC99A71D182E7A181065B0A1A57306F1
                                                                                                                                                                                                                          SHA-512:AF1A4AB0BD690F038EBC3AA5CB2CAEE575E639B4504E3BEBC8E1DE85081C780744CBAD5871D62D4F028314D165B4D71E9B3D0B68019FE9D1E49D702101602431
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tehran) {. {-9223372036854775808 12344 0 LMT}. {-1704165944 12344 0 TMT}. {-757394744 12600 0 +0330}. {247177800 14400 0 +04}. {259272000 18000 1 +04}. {277758000 14400 0 +04}. {283982400 12600 0 +0330}. {290809800 16200 1 +0330}. {306531000 12600 0 +0330}. {322432200 16200 1 +0330}. {338499000 12600 0 +0330}. {673216200 16200 1 +0330}. {685481400 12600 0 +0330}. {701209800 16200 1 +0330}. {717103800 12600 0 +0330}. {732745800 16200 1 +0330}. {748639800 12600 0 +0330}. {764281800 16200 1 +0330}. {780175800 12600 0 +0330}. {795817800 16200 1 +0330}. {811711800 12600 0 +0330}. {827353800 16200 1 +0330}. {843247800 12600 0 +0330}. {858976200 16200 1 +0330}. {874870200 12600 0 +0330}. {890512200 16200 1 +0330}. {906406200 12600 0 +0330}. {922048200 16200 1 +0330}. {937942200 12600 0 +0330}. {953584200 16200 1 +0330}. {969478200 12600 0 +
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.82789113675599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt2WFK+TT52WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb2wKsswKY7
                                                                                                                                                                                                                          MD5:D044282CC9B9F531D8136612B4AA938D
                                                                                                                                                                                                                          SHA1:5FD01E48BFFC2B54BBA48926EFD2137A91B57E0F
                                                                                                                                                                                                                          SHA-256:FE57D86184A7F4A64F3555DE3F4463531A86BB18F124534F17B09FAB825F83B4
                                                                                                                                                                                                                          SHA-512:DBBA54D68F33E51D51E816D79D83B61490BD31262DFF6037C0834BADA48CBC02F4281203D7212EDF6D96F7FF1EF3843299698BF0DFE10B5F1383AA504594505A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Asia/Tel_Aviv) $TZData(:Asia/Jerusalem).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):4.858169634371472
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8kNZ4pVAIgNqFNzO62WFK9Z752WFKvNZvn:SlSWB9IZaM3ykZ4pVAIgc3K62wKf12wc
                                                                                                                                                                                                                          MD5:B678D97B4E6E6112299746833C06C70B
                                                                                                                                                                                                                          SHA1:A49BD45DB59BDD3B7BF9159699272389E8EF77AC
                                                                                                                                                                                                                          SHA-256:6AEAE87CAD7FE358A5A1BABE6C0244A3F89403FC64C5AA19E1FFDEDCEB6CF57B
                                                                                                                                                                                                                          SHA-512:BEA10EAE5941E027D8FE9E5D5C03FAE5DCFEF7603088E71CA7CCD0461851E175AE1CC7592DFBEC63F91D840E4E0AA04B54549EB71303666E6EA16AFFF6EDA058
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Thimphu)]} {. LoadTimeZoneFile Asia/Thimphu.}.set TZData(:Asia/Thimbu) $TZData(:Asia/Thimphu).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.838482422690701
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKvNZLXGm2OHEQUTFnvSVaJKuc/v6QzFtV9gmZVFSTL:SlSWB9X52wKVZCm2OHEfnjKuc/SQnV9y
                                                                                                                                                                                                                          MD5:A52B235D91207E823482EEC1EE8C6433
                                                                                                                                                                                                                          SHA1:84826EAC8043739256E34D828D6BE8E17172A8F8
                                                                                                                                                                                                                          SHA-256:21CE1FAEDD45DED62E78D6DB24F47ED9DEC5642E4A4D7ADDF85B33F8AB82D8CA
                                                                                                                                                                                                                          SHA-512:08E8C68BF6BE5E876A59130C207D4911732EBA0F4E72603213A0AD0CC5DA8EF6AC6389AF8A0781F01B0E72CA030C9A47C46CC0FB422F5C0104A7365D818A4EB9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Thimphu) {. {-9223372036854775808 21516 0 LMT}. {-706341516 19800 0 +0530}. {560025000 21600 0 +06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):374
                                                                                                                                                                                                                          Entropy (8bit):4.405484223376936
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKvm2OHOx5PvYvmoZsOXzvmof67zd6avmoFc87e+zvmT0TgvmL:MBp52XmdHOx5PAbZ3zbi7xtbFD7e+zou
                                                                                                                                                                                                                          MD5:4549B66A26A96C10DB196B8957BB6127
                                                                                                                                                                                                                          SHA1:B2B96699AE70CA47F2B180B9AEF8FB9864AE98A1
                                                                                                                                                                                                                          SHA-256:EC533BBE242CE6A521BAED1D37E0DD0247A37FE8D36D25205520B93CF51E4595
                                                                                                                                                                                                                          SHA-512:A6C147DF80BB6D41877AD99673C49FF6AD5C1C03B587D71A70C8F7BD8D321817D9E99BFAE11F7F7C27C1A7563C9A101B6C3E65D962B3524C95113A807720ED4E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tokyo) {. {-9223372036854775808 33539 0 LMT}. {-2587712400 32400 0 JST}. {-683802000 36000 1 JDT}. {-672310800 32400 0 JST}. {-654771600 36000 1 JDT}. {-640861200 32400 0 JST}. {-620298000 36000 1 JDT}. {-609411600 32400 0 JST}. {-588848400 36000 1 JDT}. {-577962000 32400 0 JST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2043
                                                                                                                                                                                                                          Entropy (8bit):3.6031458640952554
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:539i17A9/IJ4vQayW+dRvV8YzXJIq79Af3AuyqM7FfiC/LIcy9zU9Muq2PIX/9se:ijFRRCfQucXsQk7TQy
                                                                                                                                                                                                                          MD5:436E5AA70DD662E337E0144558EA277B
                                                                                                                                                                                                                          SHA1:E268AAD83CE3CC32CB23647E961509EBB4C8AA2C
                                                                                                                                                                                                                          SHA-256:9917B2A1BFAAD1378B90879C92F157BD7912A4072BE21A2A4CB366A38F310D3B
                                                                                                                                                                                                                          SHA-512:C714CFBB58170E2291A78AD4F725613049BC9D52DB9F8685803E8F7E181D7E0C2AAF7E603D29243D2E5F4F1D8A3B0272559E7CBCB51736A8115A44E6D56FA7CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Tomsk) {. {-9223372036854775808 20391 0 LMT}. {-1578807591 21600 0 +06}. {-1247551200 25200 0 +08}. {354906000 28800 1 +08}. {370713600 25200 0 +07}. {386442000 28800 1 +08}. {402249600 25200 0 +07}. {417978000 28800 1 +08}. {433785600 25200 0 +07}. {449600400 28800 1 +08}. {465332400 25200 0 +07}. {481057200 28800 1 +08}. {496782000 25200 0 +07}. {512506800 28800 1 +08}. {528231600 25200 0 +07}. {543956400 28800 1 +08}. {559681200 25200 0 +07}. {575406000 28800 1 +08}. {591130800 25200 0 +07}. {606855600 28800 1 +08}. {622580400 25200 0 +07}. {638305200 28800 1 +08}. {654634800 25200 0 +07}. {670359600 21600 0 +07}. {670363200 25200 1 +07}. {686088000 21600 0 +06}. {695764800 25200 0 +08}. {701809200 28800 1 +08}. {717534000 25200 0 +07}. {733258800 28800 1 +08}. {748983600 25200 0 +07}. {764708400 28800 1 +08}. {780433200 252
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.8489855608543575
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8pYFwVAIgNzB0L2WFKPQOrFJ4WFKvn:SlSWB9IZaM3yWFwVAIg8L2wKPQOrFJ4H
                                                                                                                                                                                                                          MD5:AF91CF42CFBA12F55AF3E6D26A71946D
                                                                                                                                                                                                                          SHA1:673AC77D4E5B6ED7CE8AE67975372462F6AF870B
                                                                                                                                                                                                                          SHA-256:D9BCAE393D4B9EE5F308FA0C26A7A6BCE716E77DB056E75A3B39B33A227760C8
                                                                                                                                                                                                                          SHA-512:1FD61EA39FF08428486E07AF4404CEA67ACCCB600F11BA74B340A4F663EB8221BC7BF84AE677566F7DDEC0CB42F1946614CD11A9CD7824E0D6CAA804DF0EF514
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Makassar)]} {. LoadTimeZoneFile Asia/Makassar.}.set TZData(:Asia/Ujung_Pandang) $TZData(:Asia/Makassar).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1535
                                                                                                                                                                                                                          Entropy (8bit):3.6833061173791726
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQlTer9uN1xJSIA+SN16zSacGjSvtHpS9xZzS1ZjSnZS3owShjS+5MzSDZmSA/SN:569YXoIA9N0+acGuRIvc1Zun43oDhu+x
                                                                                                                                                                                                                          MD5:9C497C3C57F4FEE50C6BF35D0A3A7E5F
                                                                                                                                                                                                                          SHA1:FAFB3456CADE6AD6FFBADC699AB882FAE2591739
                                                                                                                                                                                                                          SHA-256:19855D4B0EEF8CD85D502262DF7B7F15B069B1A4D169FAB0F20F803C598C1D83
                                                                                                                                                                                                                          SHA-512:255CDF3333789771240A37CECBEB87EEAAE4561616A7066C935B67B8CA930F026F68A82315083190B175C54FBB4B2DB0126F25FDDD6C09DC374E09833225DFB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ulaanbaatar) {. {-9223372036854775808 25652 0 LMT}. {-2032931252 25200 0 +07}. {252435600 28800 0 +08}. {417974400 32400 1 +08}. {433782000 28800 0 +08}. {449596800 32400 1 +08}. {465318000 28800 0 +08}. {481046400 32400 1 +08}. {496767600 28800 0 +08}. {512496000 32400 1 +08}. {528217200 28800 0 +08}. {543945600 32400 1 +08}. {559666800 28800 0 +08}. {575395200 32400 1 +08}. {591116400 28800 0 +08}. {606844800 32400 1 +08}. {622566000 28800 0 +08}. {638294400 32400 1 +08}. {654620400 28800 0 +08}. {670348800 32400 1 +08}. {686070000 28800 0 +08}. {701798400 32400 1 +08}. {717519600 28800 0 +08}. {733248000 32400 1 +08}. {748969200 28800 0 +08}. {764697600 32400 1 +08}. {780418800 28800 0 +08}. {796147200 32400 1 +08}. {811868400 28800 0 +08}. {828201600 32400 1 +08}. {843922800 28800 0 +08}. {859651200 32400 1 +08}. {875372400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.675919405724711
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8TcXHVAIgNrfcXKxL2WFKhrMEBQWFKucXu:SlSWB9IZaM3yIVAIg7xL2wKhrMEewKI
                                                                                                                                                                                                                          MD5:73C6A7BC088A3CD92CAC2F8B019994A0
                                                                                                                                                                                                                          SHA1:74D5DCE1100F6C97DFCFAD5EFC310196F03ABED5
                                                                                                                                                                                                                          SHA-256:8F075ACF5FF86E5CDE63E178F7FCB692C209B6023C80157A2ABF6826AE63C6C3
                                                                                                                                                                                                                          SHA-512:4EAD916D2251CF3A9B336448B467282C251EE5D98299334F365711CCA8CAF9CA83600503A3346AEC9DFA9E9AF064BA6DEF570BABCC48AE5EB954DBF574A769B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Ulaanbaatar)]} {. LoadTimeZoneFile Asia/Ulaanbaatar.}.set TZData(:Asia/Ulan_Bator) $TZData(:Asia/Ulaanbaatar).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):4.962709386113539
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52WFKjmcXGm2OHEVPvUWA0GVFSTL:SlSWB9X52wKjmTm2OHEVPXA0CUn
                                                                                                                                                                                                                          MD5:6E79B04FC6FE96C90277593719BECD36
                                                                                                                                                                                                                          SHA1:81798A9F349A7DEAF9218A21B8C2D8A3E641E9B7
                                                                                                                                                                                                                          SHA-256:A73686D7BF4EE44DC7BBD1CAAF2D212D7D12478F1521BF5A628EDBEA79B99725
                                                                                                                                                                                                                          SHA-512:F6781EDA72F4B62FE128332AC2B6BDDFFF6E94DF79914C467C2A30BBE05ABE005B23C0F8A5682095FA874CB3787BD499DBBA8F1644515B6914180A68C9AB6066
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Urumqi) {. {-9223372036854775808 21020 0 LMT}. {-1325483420 21600 0 +06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1987
                                                                                                                                                                                                                          Entropy (8bit):3.684365782602096
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQueIlfR30vBOCdwdVdptQvMCTP2rF1gCzlODU9xE305r/CXVWWHs/gSNknhT:5YJkvBHwRw/P2rFGAlODU9PZUEWQgmkl
                                                                                                                                                                                                                          MD5:F648B8CDF0F44BF2733AD480D91602C2
                                                                                                                                                                                                                          SHA1:FCDB62F1D2781836AAAFF1C1B651E91A8E79A901
                                                                                                                                                                                                                          SHA-256:C94B072DDB28C27AAA936D27D5A2F1400E47E8BBFCB3EF370BF2C7252E69FB98
                                                                                                                                                                                                                          SHA-512:39E793B707C2EEF99BAE8E926A1C8CAF4A1989F71842C348A5819CC4BE3D6DC81D2781BF20CB95631EC532A345B7CD41BA88505B301CA7928E676F55252C6DDD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Ust-Nera) {. {-9223372036854775808 34374 0 LMT}. {-1579426374 28800 0 +08}. {354898800 43200 0 +12}. {370699200 39600 0 +11}. {386427600 43200 1 +12}. {402235200 39600 0 +11}. {417963600 43200 1 +12}. {433771200 39600 0 +11}. {449586000 43200 1 +12}. {465318000 39600 0 +11}. {481042800 43200 1 +12}. {496767600 39600 0 +11}. {512492400 43200 1 +12}. {528217200 39600 0 +11}. {543942000 43200 1 +12}. {559666800 39600 0 +11}. {575391600 43200 1 +12}. {591116400 39600 0 +11}. {606841200 43200 1 +12}. {622566000 39600 0 +11}. {638290800 43200 1 +12}. {654620400 39600 0 +11}. {670345200 36000 0 +11}. {670348800 39600 1 +11}. {686073600 36000 0 +10}. {695750400 39600 0 +12}. {701794800 43200 1 +12}. {717519600 39600 0 +11}. {733244400 43200 1 +12}. {748969200 39600 0 +11}. {764694000 43200 1 +12}. {780418800 39600 0 +11}. {796143600 43
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.808435832735883
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8VLYO5YFwVAIgN8ELYOAvN2WFKgTjEHp4WFKELYOun:SlSWB9IZaM3y1LewVAIgKELUvN2wKgsI
                                                                                                                                                                                                                          MD5:6372DA942647071A0514AEBF0AFEB7C7
                                                                                                                                                                                                                          SHA1:C9FB6B05DA246224D5EB016035AB905657B9D3FA
                                                                                                                                                                                                                          SHA-256:7B1A3F36E9A12B850DC06595AAE6294FAEAC98AD933B3327B866E83C0E9A1999
                                                                                                                                                                                                                          SHA-512:DC7D8753AD0D6908CA8765623EC1C4E4717833D183435957BB43E7ADB8A0D078F87319408F4C1D284CFB24BE010141B3254A36EF50C5DDCC59D7DEE5B3E33B7F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Bangkok)]} {. LoadTimeZoneFile Asia/Bangkok.}.set TZData(:Asia/Vientiane) $TZData(:Asia/Bangkok).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1991
                                                                                                                                                                                                                          Entropy (8bit):3.617868789838068
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQ6EeBGZKFyW3bEH6i4bfwRpiTQNuTHDMOFOnJfioEkfhbZUAPQ:56aZWf3bw6HfavuLoOUDEChbmAPQ
                                                                                                                                                                                                                          MD5:589D58D0819C274BD76648B290E3B6A7
                                                                                                                                                                                                                          SHA1:8EF67425A86E1663263C380B81C878EFEE107261
                                                                                                                                                                                                                          SHA-256:F7CA7543A15D0EA7380552E9CA4506E1527D5A0C9081B21A6A6CAEAD51085293
                                                                                                                                                                                                                          SHA-512:38A4264039866E82CC2CCAF52FF1AB3384A72AD9F2FF0060FC49B3D2C09CB072700F28F2CA3A0850B3E5BAB62F6AA6031ECAB2EAB09EB08833D8CD778B338BDD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Vladivostok) {. {-9223372036854775808 31651 0 LMT}. {-1487321251 32400 0 +09}. {-1247562000 36000 0 +11}. {354895200 39600 1 +11}. {370702800 36000 0 +10}. {386431200 39600 1 +11}. {402238800 36000 0 +10}. {417967200 39600 1 +11}. {433774800 36000 0 +10}. {449589600 39600 1 +11}. {465321600 36000 0 +10}. {481046400 39600 1 +11}. {496771200 36000 0 +10}. {512496000 39600 1 +11}. {528220800 36000 0 +10}. {543945600 39600 1 +11}. {559670400 36000 0 +10}. {575395200 39600 1 +11}. {591120000 36000 0 +10}. {606844800 39600 1 +11}. {622569600 36000 0 +10}. {638294400 39600 1 +11}. {654624000 36000 0 +10}. {670348800 32400 0 +10}. {670352400 36000 1 +10}. {686077200 32400 0 +09}. {695754000 36000 0 +11}. {701798400 39600 1 +11}. {717523200 36000 0 +10}. {733248000 39600 1 +11}. {748972800 36000 0 +10}. {764697600 39600 1 +11}. {7804224
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1987
                                                                                                                                                                                                                          Entropy (8bit):3.6163895181017764
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQVe7Ox4ER6oziDpiKXtyiyzilUBinUijiRziiiaSiYzYWk2HgQiMhNIziPiRikL:5Q+9InX4n7m84nPIzOtfjQhGT+
                                                                                                                                                                                                                          MD5:29C007E4E3E0015DBF39D78DF39CB790
                                                                                                                                                                                                                          SHA1:C3311ED4D7774A7DC14E0436D0B90C88ADD9BDA5
                                                                                                                                                                                                                          SHA-256:C2DD93EEAFC3E2FD6CCE0EED0633C40D8BF34331760D23A75ADCEA1719A11AE6
                                                                                                                                                                                                                          SHA-512:24609B8C01F3420CC19CA8F5AC78867DCAD1DD1A09A4B1C5356F90F0041BBCA322BC0C64D5DE4F565331674CFE15B7BF66AF6B69ACE9D18765A91B044962F781
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yakutsk) {. {-9223372036854775808 31138 0 LMT}. {-1579423138 28800 0 +08}. {-1247558400 32400 0 +10}. {354898800 36000 1 +10}. {370706400 32400 0 +09}. {386434800 36000 1 +10}. {402242400 32400 0 +09}. {417970800 36000 1 +10}. {433778400 32400 0 +09}. {449593200 36000 1 +10}. {465325200 32400 0 +09}. {481050000 36000 1 +10}. {496774800 32400 0 +09}. {512499600 36000 1 +10}. {528224400 32400 0 +09}. {543949200 36000 1 +10}. {559674000 32400 0 +09}. {575398800 36000 1 +10}. {591123600 32400 0 +09}. {606848400 36000 1 +10}. {622573200 32400 0 +09}. {638298000 36000 1 +10}. {654627600 32400 0 +09}. {670352400 28800 0 +09}. {670356000 32400 1 +09}. {686080800 28800 0 +08}. {695757600 32400 0 +10}. {701802000 36000 1 +10}. {717526800 32400 0 +09}. {733251600 36000 1 +10}. {748976400 32400 0 +09}. {764701200 36000 1 +10}. {780426000 3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):235
                                                                                                                                                                                                                          Entropy (8bit):4.635396864572362
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52wKsCm2OHGVQPZN6FCm+UlDVkvScChY/s5Uq:MBp52zmdHGuPZNAkHCpr
                                                                                                                                                                                                                          MD5:12B1D08ED6DFAB647D8F1D1371D771F6
                                                                                                                                                                                                                          SHA1:2AC1CE6E85533D6B99A8E9725F43A867833B956E
                                                                                                                                                                                                                          SHA-256:DCC9323EF236D2E3B6DAA296EB14B9208754FCD449D2351067201BCEC15381A2
                                                                                                                                                                                                                          SHA-512:C563B6A3F1B21B5FFD0F092CAF6344D5A6D74F5AC03DA44DCA6FB1B4BC0D321C6E0E8F315248D41C0D1D0FFD35F8DE31D96FBD4AE1CFE15DA52E40EE3FF7F8E3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yangon) {. {-9223372036854775808 23087 0 LMT}. {-2840163887 23087 0 RMT}. {-1577946287 23400 0 +0630}. {-873268200 32400 0 +09}. {-778410000 23400 0 +0630}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2023
                                                                                                                                                                                                                          Entropy (8bit):3.6129679767742124
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:5iKkhr7YqXZIoLybDNUoXKXmpsuNjcgy8TmQ28N7Wdw+5vDT7L:w2xd8kCdf
                                                                                                                                                                                                                          MD5:9C578B55160C4CDE22E0CD3AE449AA89
                                                                                                                                                                                                                          SHA1:DAEB24B867A835AA97E7E6A67C1AD4278015D6BB
                                                                                                                                                                                                                          SHA-256:924E60D3C57F296CDEA175D4E970FF3C68A92ADBBBA23EF37B76D7AD5D41DCE9
                                                                                                                                                                                                                          SHA-512:E3F2798038F897DF5D1D112F294BFD4E3FDBFCF4D568C4038C85289F84E0844010A6C88659C4B9D94720DBB680F2628CECEB17E6C6D0DFC231E6DCBA75068458
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yekaterinburg) {. {-9223372036854775808 14553 0 LMT}. {-1688270553 13505 0 PMT}. {-1592610305 14400 0 +04}. {-1247544000 18000 0 +06}. {354913200 21600 1 +06}. {370720800 18000 0 +05}. {386449200 21600 1 +06}. {402256800 18000 0 +05}. {417985200 21600 1 +06}. {433792800 18000 0 +05}. {449607600 21600 1 +06}. {465339600 18000 0 +05}. {481064400 21600 1 +06}. {496789200 18000 0 +05}. {512514000 21600 1 +06}. {528238800 18000 0 +05}. {543963600 21600 1 +06}. {559688400 18000 0 +05}. {575413200 21600 1 +06}. {591138000 18000 0 +05}. {606862800 21600 1 +06}. {622587600 18000 0 +05}. {638312400 21600 1 +06}. {654642000 18000 0 +05}. {670366800 14400 0 +05}. {670370400 18000 1 +05}. {686095200 14400 0 +04}. {695772000 18000 0 +06}. {701816400 21600 1 +06}. {717541200 18000 0 +05}. {733266000 21600 1 +06}. {748990800 18000 0 +05}. {764
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1959
                                                                                                                                                                                                                          Entropy (8bit):3.554930605948629
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQO4LeuVrqpkb/cXXn8UDu5u8WmFeb/RLc9qENkw/ybt8i9E60339UyuUgUU2heQ:5x79TVOZmF7N76eHvdSB4tJFFWmvN
                                                                                                                                                                                                                          MD5:013DD03BE28257101FC72E3294709AC6
                                                                                                                                                                                                                          SHA1:2EBBB3DA858B1BBC0C3CDFCBED3A4BAA0D6CE1B2
                                                                                                                                                                                                                          SHA-256:15CBC98425C074D9D5D1B107483BF68C75C318C240C7CDBDA390F8D102D76D53
                                                                                                                                                                                                                          SHA-512:10A651C82E6D5386FDC1FC95EF15F1CB0A4D8850A2324E7D62F63E1D3FBA87812045FFCF1DF013D7A3E90BBF514A4C5B2B23C547905737193B369644986D6A42
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Asia/Yerevan) {. {-9223372036854775808 10680 0 LMT}. {-1441162680 10800 0 +03}. {-405140400 14400 0 +04}. {354916800 18000 1 +04}. {370724400 14400 0 +04}. {386452800 18000 1 +04}. {402260400 14400 0 +04}. {417988800 18000 1 +04}. {433796400 14400 0 +04}. {449611200 18000 1 +04}. {465343200 14400 0 +04}. {481068000 18000 1 +04}. {496792800 14400 0 +04}. {512517600 18000 1 +04}. {528242400 14400 0 +04}. {543967200 18000 1 +04}. {559692000 14400 0 +04}. {575416800 18000 1 +04}. {591141600 14400 0 +04}. {606866400 18000 1 +04}. {622591200 14400 0 +04}. {638316000 18000 1 +04}. {654645600 14400 0 +04}. {670370400 10800 0 +03}. {670374000 14400 1 +03}. {686098800 10800 0 +03}. {701823600 14400 1 +03}. {717548400 10800 0 +03}. {733273200 14400 1 +03}. {748998000 10800 0 +03}. {764722800 14400 1 +03}. {780447600 10800 0 +03}. {796172400 14
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9474
                                                                                                                                                                                                                          Entropy (8bit):3.4598088631836625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Mw7Jfsud5vCGy0luUDHaXZgsN/FWVFjHv0:Mwdf/d5vCGy0luZN9WVFjHv0
                                                                                                                                                                                                                          MD5:E9C33EAACFD20C021CE94292068CC1D8
                                                                                                                                                                                                                          SHA1:9F8C0A4E07C33349C6ACDB0564771AEB11098B9D
                                                                                                                                                                                                                          SHA-256:8E2B427733BF8DBCE5171DC57F0892F0987CF1BD7941DA40048CB53B86B23E0D
                                                                                                                                                                                                                          SHA-512:8C77CF236855C51E03911A8203A2E81FC728C21A904B4962EA18F5FD39B00174D8A365FC0CA42E4EDE12DA84DD6445CFBB1B3E922189EB6B13AF6BC802E2B405
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Azores) {. {-9223372036854775808 -6160 0 LMT}. {-2713904240 -6872 0 HMT}. {-1830376800 -7200 0 -02}. {-1689548400 -3600 1 -01}. {-1677794400 -7200 0 -02}. {-1667430000 -3600 1 -01}. {-1647730800 -7200 0 -02}. {-1635807600 -3600 1 -01}. {-1616194800 -7200 0 -02}. {-1604358000 -3600 1 -01}. {-1584658800 -7200 0 -02}. {-1572735600 -3600 1 -01}. {-1553036400 -7200 0 -02}. {-1541199600 -3600 1 -01}. {-1521500400 -7200 0 -02}. {-1442444400 -3600 1 -01}. {-1426806000 -7200 0 -02}. {-1379286000 -3600 1 -01}. {-1364770800 -7200 0 -02}. {-1348441200 -3600 1 -01}. {-1333321200 -7200 0 -02}. {-1316386800 -3600 1 -01}. {-1301266800 -7200 0 -02}. {-1284332400 -3600 1 -01}. {-1269817200 -7200 0 -02}. {-1221433200 -3600 1 -01}. {-1206918000 -7200 0 -02}. {-1191193200 -3600 1 -01}. {-1175468400 -7200 0 -02}. {-1127689200 -3600 1 -01}. {-111196440
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7684
                                                                                                                                                                                                                          Entropy (8bit):3.7376923223964162
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:UdPvxrPGgFEUlpde9pXbO53oVmM7IEc2fVGYu2yeB/T/eleWmBk81kS/kV6kef4E:lJv
                                                                                                                                                                                                                          MD5:E55A91A96E1DC267AAEFAF27866F0A90
                                                                                                                                                                                                                          SHA1:A3E8DB332114397F4F487256E9168E73784D3637
                                                                                                                                                                                                                          SHA-256:A2EB47B25B3A389907DD242C86288073B0694B030B244CCF90421C0B510267BD
                                                                                                                                                                                                                          SHA-512:9A8140365D76F1A83A98A35593638F2C047B3D2B1E9D0F6ACB2B321EBDB9CC5B6C8CCD3C110B127A12DCDB7D9ED16A8F7DB7DA7A8B4587486D060FACCA23F993
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Bermuda) {. {-9223372036854775808 -15558 0 LMT}. {-1262281242 -14400 0 AST}. {136360800 -10800 0 ADT}. {152082000 -14400 0 AST}. {167810400 -10800 1 ADT}. {183531600 -14400 0 AST}. {189316800 -14400 0 AST}. {199260000 -10800 1 ADT}. {215586000 -14400 0 AST}. {230709600 -10800 1 ADT}. {247035600 -14400 0 AST}. {262764000 -10800 1 ADT}. {278485200 -14400 0 AST}. {294213600 -10800 1 ADT}. {309934800 -14400 0 AST}. {325663200 -10800 1 ADT}. {341384400 -14400 0 AST}. {357112800 -10800 1 ADT}. {372834000 -14400 0 AST}. {388562400 -10800 1 ADT}. {404888400 -14400 0 AST}. {420012000 -10800 1 ADT}. {436338000 -14400 0 AST}. {452066400 -10800 1 ADT}. {467787600 -14400 0 AST}. {483516000 -10800 1 ADT}. {499237200 -14400 0 AST}. {514965600 -10800 1 ADT}. {530686800 -14400 0 AST}. {544600800 -10800 1 ADT}. {562136400 -14400 0 AST}. {576050
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6609
                                                                                                                                                                                                                          Entropy (8bit):3.7165368441152715
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:KXu/30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:KX5IMj544IrvfMsbxZTH7qwQ
                                                                                                                                                                                                                          MD5:230C7B4BB6D64818889E573ADBE97E35
                                                                                                                                                                                                                          SHA1:97E6D43C3F9446C9A224DAF69F31CA55721BFC59
                                                                                                                                                                                                                          SHA-256:6CDA69514774093B7219BB079077322F5C783DBAD137F89181E8434D8BD2A6CF
                                                                                                                                                                                                                          SHA-512:A17246BC44C1FDC971304E0D2E8F721E254880FB725F1AACCA05645FFE82F2AF3791234F02824E357CBDD51D529C882E21B8712735C32420074F3B75813DE27C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Canary) {. {-9223372036854775808 -3696 0 LMT}. {-1509663504 -3600 0 -01}. {-733874400 0 0 WET}. {323827200 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WET
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):237
                                                                                                                                                                                                                          Entropy (8bit):4.579111187402317
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X52RQ7Sm2OHDVJlvQV2FlRo/FFuykVvQV2FR+nmY:MBp5267SmdHDVwiHoGyLiomY
                                                                                                                                                                                                                          MD5:51BE50511F1FA17A6AF9D4AE892FAFDA
                                                                                                                                                                                                                          SHA1:2491743E429AAE5DF70CC3E791DC9875E30F152D
                                                                                                                                                                                                                          SHA-256:E444B51A4511F83D616E816B770A60088EA94B9286112F47331122F44119541D
                                                                                                                                                                                                                          SHA-512:A509146E25174D9938AF13B78CF052E45F50A61B834C276607B281EF7B81C6696A793A3769B355C8C804A74F37ADDEBBCDC2A69E3B938EB5A2A9742BE135A4A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Cape_Verde) {. {-9223372036854775808 -5644 0 LMT}. {-1830376800 -7200 0 -02}. {-862610400 -3600 1 -01}. {-764118000 -7200 0 -02}. {186120000 -3600 0 -01}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.655846706649014
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqLG4E2wFVAIgvMG4EeL2RQqG4EZrB/4RQqG4Ei:SlSWB9IZaM3yCwFVAIgvgL2RQ1rB/4R/
                                                                                                                                                                                                                          MD5:08C5EE09B8BE16C5E974BA8070D448EA
                                                                                                                                                                                                                          SHA1:D171C194F6D61A891D3390FF6492AEFB0F67646A
                                                                                                                                                                                                                          SHA-256:7C6A6BCF5AAEAB1BB57482DF1BBC934D367390782F6D8C5783DBBBE663169A9B
                                                                                                                                                                                                                          SHA-512:E885F3C30DBE178F88464ED505BA1B838848E6BB15C0D27733932CD0634174D9645C5098686E183CC93CB46DE7EB0DBF2EB64CB77A50FC337E2581E25107C9A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Faroe)]} {. LoadTimeZoneFile Atlantic/Faroe.}.set TZData(:Atlantic/Faeroe) $TZData(:Atlantic/Faroe).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6551
                                                                                                                                                                                                                          Entropy (8bit):3.7148806034051316
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:9bd30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:8IMj544IrvfMsbxZTH7qwQ
                                                                                                                                                                                                                          MD5:918E1825106C5C73B203B718918311DC
                                                                                                                                                                                                                          SHA1:7C31B3521B396FE6BE7162BAECC4CFB4740F622B
                                                                                                                                                                                                                          SHA-256:B648E691D8F3417B77EFB6D6C2F5052B3C4EAF8B5354E018EE2E9BD26F867B71
                                                                                                                                                                                                                          SHA-512:5B1B5FE82A13127E3C63C8FB0A8CBD45A7277EF29720B937BB3174E8301830018755416D604F3551622E2E4D365D35E4EE1DF39B587A73E43AE0C68D1996B771
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Faroe) {. {-9223372036854775808 -1624 0 LMT}. {-1955748776 0 0 WET}. {347155200 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 3600 1 WEST}. {780454800 0 0 WET}. {796179600 3600 1 WEST}. {811904400 0 0 WET}. {828234000 3600 1 WEST}. {846378000 0 0 WET}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.92967249261586
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVyWJooedVAIgoqxWJ0YF2RQqG0EHEcAg/h8QasWJ/n:SlSWB9IZaM3ymSDdVAIgo2Q2RQaK8H
                                                                                                                                                                                                                          MD5:AD9B5217497DBC1CE598573B85F3C056
                                                                                                                                                                                                                          SHA1:60984544F5BBD4A5B2B8F43741D66A573A2CF1DC
                                                                                                                                                                                                                          SHA-256:BE291E952254B6F0C95C2E2497BE12410D7F1E36D0D1035B3A9BC65D0EDCB65F
                                                                                                                                                                                                                          SHA-512:F5D47008495425C386EBAB426195393168E402726405CF23826571E548A3CEFABBA51D87D637C0724FF2CC4F1276D81EACF14D0F9CFC7CBFCC025EEFA0960278
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Oslo)]} {. LoadTimeZoneFile Europe/Oslo.}.set TZData(:Atlantic/Jan_Mayen) $TZData(:Europe/Oslo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9307
                                                                                                                                                                                                                          Entropy (8bit):3.715509739111961
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:jZqAUb1iF0Rf0IMj544IrvfMsbxZTH7qwQ:jZqAUb1iF0RffMUM8xZTH7qwQ
                                                                                                                                                                                                                          MD5:5D2EAAA0D116DD1C7965FCB229678FB4
                                                                                                                                                                                                                          SHA1:DA59652A8E57DE9FAF02ED6EB9D863CD34642E6C
                                                                                                                                                                                                                          SHA-256:8AAF754C1F9AABEA185808F21B864B02815D24451DB38BE8629DA4C57141E8F5
                                                                                                                                                                                                                          SHA-512:E561B09A53CEC764B0B2B2544E774577553F6DFEFB80AEC04698C2B0FBEBBC7F03E11C31627654346752B4F85BB3EF669397162599F3ED6B8B8D286521447361
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Madeira) {. {-9223372036854775808 -4056 0 LMT}. {-2713906344 -4056 0 FMT}. {-1830380400 -3600 0 -01}. {-1689552000 0 1 +00}. {-1677798000 -3600 0 -01}. {-1667433600 0 1 +00}. {-1647734400 -3600 0 -01}. {-1635811200 0 1 +00}. {-1616198400 -3600 0 -01}. {-1604361600 0 1 +00}. {-1584662400 -3600 0 -01}. {-1572739200 0 1 +00}. {-1553040000 -3600 0 -01}. {-1541203200 0 1 +00}. {-1521504000 -3600 0 -01}. {-1442448000 0 1 +00}. {-1426809600 -3600 0 -01}. {-1379289600 0 1 +00}. {-1364774400 -3600 0 -01}. {-1348444800 0 1 +00}. {-1333324800 -3600 0 -01}. {-1316390400 0 1 +00}. {-1301270400 -3600 0 -01}. {-1284336000 0 1 +00}. {-1269820800 -3600 0 -01}. {-1221436800 0 1 +00}. {-1206921600 -3600 0 -01}. {-1191196800 0 1 +00}. {-1175472000 -3600 0 -01}. {-1127692800 0 1 +00}. {-1111968000 -3600 0 -01}. {-1096848000 0 1 +00}. {-10805184
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1962
                                                                                                                                                                                                                          Entropy (8bit):3.623004596418002
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cQleDGC/2qdDW4saQCwjoDWFGKRJYHL/Tc7PjEWlyvKekkdoUOCOfNOaRqOjo/Kj:5r2cd5fmYEfAfYaRDjys/
                                                                                                                                                                                                                          MD5:0E3020348755C67F6A48F4C3F0F4E51D
                                                                                                                                                                                                                          SHA1:FBA44F3DEBC47274A1C9CC4AE5A5F9B363157BF1
                                                                                                                                                                                                                          SHA-256:83566E49A37703E11CF0884558BE3DD8827BD79409D04C5D053BCA69D666CEC8
                                                                                                                                                                                                                          SHA-512:97F78A8C98B03705188B6F4D622F3B88D7C85B2FF1578DA24C4CD85C163FB05DBD908413B5F355F001755705F22943B1DA6C2A58A902751787238110D2A81F95
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Reykjavik) {. {-9223372036854775808 -5280 0 LMT}. {-1956609120 -3600 0 -01}. {-1668211200 0 1 -01}. {-1647212400 -3600 0 -01}. {-1636675200 0 1 -01}. {-1613430000 -3600 0 -01}. {-1605139200 0 1 -01}. {-1581894000 -3600 0 -01}. {-1539561600 0 1 -01}. {-1531350000 -3600 0 -01}. {-968025600 0 1 -01}. {-952293600 -3600 0 -01}. {-942008400 0 1 -01}. {-920239200 -3600 0 -01}. {-909957600 0 1 -01}. {-888789600 -3600 0 -01}. {-877903200 0 1 -01}. {-857944800 -3600 0 -01}. {-846453600 0 1 -01}. {-826495200 -3600 0 -01}. {-815004000 0 1 -01}. {-795045600 -3600 0 -01}. {-783554400 0 1 -01}. {-762991200 -3600 0 -01}. {-752104800 0 1 -01}. {-731541600 -3600 0 -01}. {-717631200 0 1 -01}. {-700092000 -3600 0 -01}. {-686181600 0 1 -01}. {-668642400 -3600 0 -01}. {-654732000 0 1 -01}. {-636588000 -3600 0 -01}. {-623282400 0 1 -01}. {-605
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):4.967019958156088
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx52RQqGtlN62/EUXGm2OHXT14YvXhFvdQVIK:SlSWB9X52RQrlo2Mbm2OHXqYPTFQV7
                                                                                                                                                                                                                          MD5:421C0110145FB8288B08133DD1409E75
                                                                                                                                                                                                                          SHA1:CD2D62E739FF1715268B6DFB2C523ED3C76B7A90
                                                                                                                                                                                                                          SHA-256:4B78F3E086B2A8B4366362AB5CEF2DF6A28E2B0EA8279C0FE9414E974BBC2E08
                                                                                                                                                                                                                          SHA-512:3B20413C6E15A846B3CC730EBCD77D8AA170ECC262E160BB996AA79173F30D42588352C38EA1B44539A62D77B2BC8418A3C4B7507997AF4F15FBD647BF567A88
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/South_Georgia) {. {-9223372036854775808 -8768 0 LMT}. {-2524512832 -7200 0 -02}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.831929124818878
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqss1kvFVAIgNGE4Rvt2RQqGt4r+DcsP:SlSWB9IZaM3y7sYFVAIgNT4tt2RQr4rC
                                                                                                                                                                                                                          MD5:8F4668F0D79577139B59A80D714E45A5
                                                                                                                                                                                                                          SHA1:BCD79EDCCB687A2E74794B8CFDE99A7FEC294811
                                                                                                                                                                                                                          SHA-256:C78C4E980A378B781ED6D2EA72ABAEF8FFED186538DEB18B61D94B575734FC6A
                                                                                                                                                                                                                          SHA-512:08D1472377229BC76A496259344263993791B4DF3F83D94F798779249A5CAE15F6B4341A665387780EA8B1278E9D5FFBCA1BCDE06B3E54750E32078FA482ABD6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Abidjan)]} {. LoadTimeZoneFile Africa/Abidjan.}.set TZData(:Atlantic/St_Helena) $TZData(:Africa/Abidjan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2181
                                                                                                                                                                                                                          Entropy (8bit):3.570822154620431
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:50wIS1SbSRxS5Sh/ScoOG2S+SZSgSsSs/SYS6SDSF3SLShS7KXS6SkSGSn/S+7SG:PIEg8CCcOFVOfjl/nxw6cmrXlXdgj7E6
                                                                                                                                                                                                                          MD5:747D86EC0B020967D989E3D6C4DD273F
                                                                                                                                                                                                                          SHA1:567F9E398FEDF58D68F73EB16CE33F8483B44ECE
                                                                                                                                                                                                                          SHA-256:F88641114EC11D4129EEFE59CCD587AAD9C1898C3AFEE8A7CB85962312637640
                                                                                                                                                                                                                          SHA-512:B7A97E1DCC9E52A0565B50C8865A955924AFED08C21BC1DCCF73A3327C98D0A98706C03913A4872BD24DD2167B2170A6134CA177B20305DEF23D72ADDD668FB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Atlantic/Stanley) {. {-9223372036854775808 -13884 0 LMT}. {-2524507716 -13884 0 SMT}. {-1824235716 -14400 0 -04}. {-1018209600 -10800 1 -04}. {-1003093200 -14400 0 -04}. {-986760000 -10800 1 -04}. {-971643600 -14400 0 -04}. {-954705600 -10800 1 -04}. {-939589200 -14400 0 -04}. {-923256000 -10800 1 -04}. {-908139600 -14400 0 -04}. {-891806400 -10800 1 -04}. {-876690000 -14400 0 -04}. {-860356800 -10800 1 -04}. {420606000 -7200 0 -03}. {433303200 -7200 1 -03}. {452052000 -10800 0 -03}. {464151600 -7200 1 -03}. {483501600 -10800 0 -03}. {495597600 -14400 0 -04}. {495604800 -10800 1 -04}. {514350000 -14400 0 -04}. {527054400 -10800 1 -04}. {545799600 -14400 0 -04}. {558504000 -10800 1 -04}. {577249200 -14400 0 -04}. {589953600 -10800 1 -04}. {608698800 -14400 0 -04}. {621403200 -10800 1 -04}. {640753200 -14400 0 -04}. {652852800 -10800 1 -04}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.813373101386862
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjpMFBx/h4QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCeMFB/4D2
                                                                                                                                                                                                                          MD5:F48AD4B81CD3034F6E5D3CA1B5A8BDD4
                                                                                                                                                                                                                          SHA1:676FE3F50E3E132C1FD185A1EE1D8C830763204F
                                                                                                                                                                                                                          SHA-256:553D7DA9A2EDBD933E8920573AE6BCBAA00302817939046CF257CAEACEC19FAD
                                                                                                                                                                                                                          SHA-512:36A4E2286FBEF2F4ED4B9CD1A71136E227FEF4B693F9F43649B790E859221EE470679A7E3C283770DA5CB0113A1C8C1F99480E7020328FFE3E9C870798B092F5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/ACT) $TZData(:Australia/Sydney).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8099
                                                                                                                                                                                                                          Entropy (8bit):3.812665609163787
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JPtFF+Wc4CNphbQbPzpRtYac1w6N5HxnLmPaod/gWFXht/c+u8dRYaaiqcdtXHVf:JP5+zNMdYacv5HhLmPajSXz5HV5x
                                                                                                                                                                                                                          MD5:4E73BDB571DBF2625E14E38B84C122B4
                                                                                                                                                                                                                          SHA1:B9D7B7D2855D102800B53FB304633F5BC961A8D0
                                                                                                                                                                                                                          SHA-256:9138DF8A3DE8BE4099C9C14917B5C5FD7EB14751ACCD66950E0FDB686555FFD6
                                                                                                                                                                                                                          SHA-512:CF9AB3E9A7C1A76BCC113828ABAF88FE83AAF5CAD7BD181201E06A0CF43E30BA8817AAA88AB3F0F14F459599D91F63ECE851F095154050263C5AD08B2275B4C7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Adelaide) {. {-9223372036854775808 33260 0 LMT}. {-2364110060 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}. {31501800 34200 0 ACST}. {57688200 37800 1 ACDT}. {67969800 34200 0 ACST}. {89137800 37800 1 ACDT}. {100024200 34200 0 ACST}. {120587400 37800 1 ACDT}. {131473800 34200 0 ACST}. {152037000 37800 1 ACDT}. {162923400 34200 0 ACST}. {183486600 37800 1 ACDT}. {194977800 34200 0 ACST}. {215541000 37800 1 ACDT}. {226427400 34200 0 ACST}. {246990600 37800 1 ACDT}. {257877000 34200 0 ACST}. {278440200 37800 1 ACDT}. {289326600 34200 0 ACST}. {309889800 37800 1 ACDT}. {320776200 34200 0 ACST}. {341339400 37800 1 ACDT}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):651
                                                                                                                                                                                                                          Entropy (8bit):4.265580091557009
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52nmdHLOYPv+tCdd8xdsWz9ag5J4UVdKcWWC:cQne6skVk
                                                                                                                                                                                                                          MD5:296B4B78CEE05805E5EE53B4D5F7284F
                                                                                                                                                                                                                          SHA1:DDB5B448E99F278C633B2DBD5A816C4DE28DC726
                                                                                                                                                                                                                          SHA-256:2580C3EEEC029572A1FF629E393F64E326DEDAA96015641165813718A8891C4D
                                                                                                                                                                                                                          SHA-512:9DE71000BB8AC48A82D83399BD707B661B50882EEBFE2A7E58A81A2F6C04B1F711DAE3AA09A77A9EE265FB633B8883D2C01867AF96F8BE5137119E4FB447DF8C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Brisbane) {. {-9223372036854775808 36728 0 LMT}. {-2366791928 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {625593600 39600 1 AEDT}. {636480000 36000 0 AEST}. {657043200 39600 1 AEDT}. {667929600 36000 0 AEST}. {688492800 39600 1 AEDT}. {699379200 36000 0 AEST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8162
                                                                                                                                                                                                                          Entropy (8bit):3.820479465698825
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:EkxtFF+Wc4Yphbhd1zCRtYac1w6N5HxnLmPaod/gWFXht/c+u8dRYaaiqcdtXHVf:Ekx5+X5sYacv5HhLmPajSXz5HV5x
                                                                                                                                                                                                                          MD5:B4AF947B4737537DF09A039D1E500FB8
                                                                                                                                                                                                                          SHA1:CCC0DC52D586BFAA7A0E70C80709231B4BB93C54
                                                                                                                                                                                                                          SHA-256:80BBD6D25D4E4EFA234EAD3CB4EB801DC576D1348B9A3E1B58F729FEB688196D
                                                                                                                                                                                                                          SHA-512:3B27C36FA3034CB371DD07C992B3A5B1357FC7A892C35910DA139C7DA560DDC0AA1E95966438776F75397E7219A7DA0AD4AD6FB922B5E0BE2828D3534488BFD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Broken_Hill) {. {-9223372036854775808 33948 0 LMT}. {-2364110748 36000 0 AEST}. {-2314951200 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}. {31501800 34200 0 ACST}. {57688200 37800 1 ACDT}. {67969800 34200 0 ACST}. {89137800 37800 1 ACDT}. {100024200 34200 0 ACST}. {120587400 37800 1 ACDT}. {131473800 34200 0 ACST}. {152037000 37800 1 ACDT}. {162923400 34200 0 ACST}. {183486600 37800 1 ACDT}. {194977800 34200 0 ACST}. {215541000 37800 1 ACDT}. {226427400 34200 0 ACST}. {246990600 37800 1 ACDT}. {257877000 34200 0 ACST}. {278440200 37800 1 ACDT}. {289326600 34200 0 ACST}. {309889800 37800 1 ACDT}. {320776200 34200 0 ACS
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.80238049701662
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjnSV1+QWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DCcq+DCyu
                                                                                                                                                                                                                          MD5:16F9CFC4C5B9D5F9F9DB9346CECE4393
                                                                                                                                                                                                                          SHA1:ED1ED7BA73EB287D2C8807C4F8EF3EFA516F5A68
                                                                                                                                                                                                                          SHA-256:853A159B8503B9E8F42BBCE60496722D0A334FD79F30448BAD651F18BA388055
                                                                                                                                                                                                                          SHA-512:9572CCB1BC499BADA72B5FE533B56156DB9EB0DEDFD4AE4397AD60F2A8AF5991F7B1B06A1B8D14C73832543AF8C12F5B16A9A80D093BF0C7ED6E38FF8B66E197
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/Canberra) $TZData(:Australia/Sydney).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8097
                                                                                                                                                                                                                          Entropy (8bit):3.7668602204696375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:GJiG+HuKIyymp8tLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:GJqXytLhbVXdnPQler
                                                                                                                                                                                                                          MD5:7E0D1435E11C9AE84EF1A863D1D90C61
                                                                                                                                                                                                                          SHA1:CE76A3D902221F0EF9D8C25EB2D46A63D0D09D0B
                                                                                                                                                                                                                          SHA-256:3C0B35627729316A391C5A0BEE3A0E353A0BAEAD5E49CE7827E53D0F49FD6723
                                                                                                                                                                                                                          SHA-512:D262294AC611396633184147B0F6656290BF97A298D6F7EC025E1D88AAC5343363744FD1CB849CDE84F3C1B2CF860CFA7CA43453ADBF68B0903DA1361F0DCD69
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Currie) {. {-9223372036854775808 34528 0 LMT}. {-2345794528 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {47138400 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):422
                                                                                                                                                                                                                          Entropy (8bit):4.4678452003570435
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52umdHPPZUj/sVdFFtf/FFAXFFwFFgh:cQuenZq/sVd/tH/AX/w/C
                                                                                                                                                                                                                          MD5:FC9689FEF4223726207271E2EAAE6548
                                                                                                                                                                                                                          SHA1:26D0B4FC2AD943FCAC90F179F7DF6C18EE12EBB8
                                                                                                                                                                                                                          SHA-256:C556C796CCD3C63D9F694535287DC42BB63140C8ED39D31FDA0DA6E94D660A1C
                                                                                                                                                                                                                          SHA-512:7898C0DE77297FBAA6AAF9D15CB9765DAF63ED4761BA181D0D1A590A6F19A6B7F6E94564A80EB691ED2D89C96D68449BF57816E4093E5011B93D30C3E1624D60
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Darwin) {. {-9223372036854775808 31400 0 LMT}. {-2364108200 32400 0 ACST}. {-2230189200 34200 0 ACST}. {-1672565340 37800 1 ACDT}. {-1665390600 34200 0 ACST}. {-883639800 37800 1 ACDT}. {-876126600 34200 0 ACST}. {-860398200 37800 1 ACDT}. {-844677000 34200 0 ACST}. {-828343800 37800 1 ACDT}. {-813227400 34200 0 ACST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):734
                                                                                                                                                                                                                          Entropy (8bit):4.049000512576295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp527JmdHvOYPV2oV2NF2AUV2ikUF2XV2ouwF2aUF2giV2XHVKF2qV2sF2jV2oA:cQ7JemssNLdUpouw5o5X0mszo4Ui/MXu
                                                                                                                                                                                                                          MD5:F997E4624049132CEC09AC77FBA839E3
                                                                                                                                                                                                                          SHA1:7BD0097EF75621646CE1969A61596F7FA2E75188
                                                                                                                                                                                                                          SHA-256:C3E63F8BC7739A23C21DE71425EDDA7927C31D00BC9E23D3A265C93885248991
                                                                                                                                                                                                                          SHA-512:B50EDBBA11D1B8FC7DF13A9DBDE9314E1694E36F2CB810C0160406406161CC8FD52BDBFD13D10EEABE2859FA7AEBC35EBF9AB826EB92BBF26D92EEDD15633649
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Eucla) {. {-9223372036854775808 30928 0 LMT}. {-2337928528 31500 0 +0945}. {-1672562640 35100 1 +0945}. {-1665387900 31500 0 +0945}. {-883637100 35100 1 +0945}. {-876123900 31500 0 +0945}. {-860395500 35100 1 +0945}. {-844674300 31500 0 +0945}. {-836473500 35100 0 +0945}. {152039700 35100 1 +0945}. {162926100 31500 0 +0945}. {436295700 35100 1 +0945}. {447182100 31500 0 +0945}. {690311700 35100 1 +0945}. {699383700 31500 0 +0945}. {1165079700 35100 1 +0945}. {1174756500 31500 0 +0945}. {1193505300 35100 1 +0945}. {1206810900 31500 0 +0945}. {1224954900 35100 1 +0945}. {1238260500 31500 0 +0945}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8325
                                                                                                                                                                                                                          Entropy (8bit):3.767204262183229
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:8xKiG+HuKIyymp8tLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:8xKqXytLhbVXdnPQler
                                                                                                                                                                                                                          MD5:67AF9A2B827308DD9F7ABEC9441C3250
                                                                                                                                                                                                                          SHA1:CD87DD4181B41E66EFEA9C7311D5B7191F41EA3A
                                                                                                                                                                                                                          SHA-256:814BD785B5ACDE9D2F4FC6E592E919BA0FE1C3499AFC1071B7FA02608B6032AB
                                                                                                                                                                                                                          SHA-512:BC6B8CE215B3B4AC358EB989FB1BB5C6AD61B39B7BBD36AAA924A2352E823C029131E79DA927FEEBDD5CF759FDE527F39089C93B0826995D37052362BEAE09F6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Hobart) {. {-9223372036854775808 35356 0 LMT}. {-2345795356 36000 0 AEST}. {-1680508800 39600 1 AEDT}. {-1669892400 39600 0 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {-94730400 36000 0 AEST}. {-71136000 39600 1 AEDT}. {-55411200 36000 0 AEST}. {-37267200 39600 1 AEDT}. {-25776000 36000 0 AEST}. {-5817600 39600 1 AEDT}. {5673600 36000 0 AEST}. {25632000 39600 1 AEDT}. {37728000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):194
                                                                                                                                                                                                                          Entropy (8bit):4.865814837459796
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3yIoGEowFVAIgjG/L2DCkx/2DCPGT:MBaIMje0QL2a7
                                                                                                                                                                                                                          MD5:1221FC8932CA3DCA431304AF660840F0
                                                                                                                                                                                                                          SHA1:5E023E37D98EA1321B10D36A79B26DF1A017F9D5
                                                                                                                                                                                                                          SHA-256:EB8FDBCFDE9E2A2AA829E784D402966F61A5BF6F2034E0CB06A24FACB5B87874
                                                                                                                                                                                                                          SHA-512:EB19FE74DC13456D0F9F1EDC9C444793A4011D3B65ADF6C7E7A405504079EB3A0C27F69DDA662F797FE363948E93833422F5DC3C1891AA7D414B062BE4DD3887
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Lord_Howe)]} {. LoadTimeZoneFile Australia/Lord_Howe.}.set TZData(:Australia/LHI) $TZData(:Australia/Lord_Howe).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):796
                                                                                                                                                                                                                          Entropy (8bit):4.1890768067004
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52gCmdHVP/+tCdd8xdsWz9ag5J4UVdKcWW3ty/yJATUJrRxC:cQgCeRUVfl7w
                                                                                                                                                                                                                          MD5:08E88B2169BC76172E40515F9DA2C147
                                                                                                                                                                                                                          SHA1:5C03B7C9748E63C2B437C97F8ED923A9F3E374E7
                                                                                                                                                                                                                          SHA-256:9E3558C8514E97274D9F938E9841C5E3355E738BBD55BCB17FA27FF0E0276AEA
                                                                                                                                                                                                                          SHA-512:39E10639C97DE82428818B9C5D059BA853A17113351BAEE2512806AC3066EDDF0294859519AFBE425E0D1315B1A090F84C08CEFEDCE2A3D3A38EEF782234D8C4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lindeman) {. {-9223372036854775808 35756 0 LMT}. {-2366790956 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {625593600 39600 1 AEDT}. {636480000 36000 0 AEST}. {657043200 39600 1 AEDT}. {667929600 36000 0 AEST}. {688492800 39600 1 AEDT}. {699379200 36000 0 AEST}. {709912800 36000 0 AEST}. {719942400 39600 1 AEDT}. {731433600 36000 0 AEST}. {751996800 39600 1 AEDT}. {762883200 36000 0 AEST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7519
                                                                                                                                                                                                                          Entropy (8bit):3.4688530726187112
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:zVjDVP0Izj1cdhsARcuhb4F3LbSZYt2U/gTpxxM3a6Z/nEgAmQso4QgDD:zv3qrcuhb4FbbCegi
                                                                                                                                                                                                                          MD5:169FF1BE6B6407E853AAF9F6E9A9A047
                                                                                                                                                                                                                          SHA1:C573582B8EF897D3AE5CA0FB089BE31F6ED076EB
                                                                                                                                                                                                                          SHA-256:3C7C5CF7300957F73E9249FC8BF282F7CEE262849DD5D326F476E1AE8A7B8DD5
                                                                                                                                                                                                                          SHA-512:BD8315022E8B190976FCED98252FCA0C248D857AC5045D741F6902871F0E3C158B248628DF9BA124A38AE878398F8BEA614254400F329D01F60EE50666AEE118
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Lord_Howe) {. {-9223372036854775808 38180 0 LMT}. {-2364114980 36000 0 AEST}. {352216800 37800 0 +1030}. {372785400 41400 1 +1030}. {384273000 37800 0 +1030}. {404839800 41400 1 +1030}. {415722600 37800 0 +1030}. {436289400 41400 1 +1030}. {447172200 37800 0 +1030}. {467739000 41400 1 +1030}. {478621800 37800 0 +1030}. {488984400 37800 0 +1030}. {499188600 39600 1 +1030}. {511282800 37800 0 +1030}. {530033400 39600 1 +1030}. {542732400 37800 0 +1030}. {562087800 39600 1 +1030}. {574786800 37800 0 +1030}. {594142200 39600 1 +1030}. {606236400 37800 0 +1030}. {625591800 39600 1 +1030}. {636476400 37800 0 +1030}. {657041400 39600 1 +1030}. {667926000 37800 0 +1030}. {688491000 39600 1 +1030}. {699375600 37800 0 +1030}. {719940600 39600 1 +1030}. {731430000 37800 0 +1030}. {751995000 39600 1 +1030}. {762879600 37800 0 +1030}. {78344
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8069
                                                                                                                                                                                                                          Entropy (8bit):3.769669933493392
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:sriG+vi8GyddsYtLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:sr/2tLhbVXdnPQler
                                                                                                                                                                                                                          MD5:E38FDAF8D9A9B1D6F2B1A8E10B9886F4
                                                                                                                                                                                                                          SHA1:6188BD62E94194DB469BE93224A396D08A986D4D
                                                                                                                                                                                                                          SHA-256:399F727CB39D90520AD6AE78A8963F918A490A813BC4FF2D94A37B0315F52D99
                                                                                                                                                                                                                          SHA-512:79FDCFF5066636C3218751C8B2B658C6B7A6864264DCC28B47843EAEFDD5564AC5E4B7A66E3D1B0D25DB86D6C6ED55D1599F1FE2C169085A8769E037E0E954BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Melbourne) {. {-9223372036854775808 34792 0 LMT}. {-2364111592 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}. {352224000 36000 0 AEST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.8456659038249
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq/xJjLHVAIgoXjLSt2QWCCjREeQWCCjLu:SlSWB9IZaM3yI9HVAIgmo2DC5eDCyu
                                                                                                                                                                                                                          MD5:AE3539C49047BE3F8ABAD1AC670975F1
                                                                                                                                                                                                                          SHA1:62CD5C3DB618B9FE5630B197AB3A9729B565CA41
                                                                                                                                                                                                                          SHA-256:938A557C069B8E0BE8F52D721119CBA9A694F62CF8A7A11D68FD230CC231E17C
                                                                                                                                                                                                                          SHA-512:6F143B50C1EEC1D77F87DD5B0FFCF6625800E247400AA58361748BFEA0626E2CDA9C3FD2A4C269B3218D28FF1FB8533F4F6741F6B2C5E83F9C84A5882C86716B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Sydney)]} {. LoadTimeZoneFile Australia/Sydney.}.set TZData(:Australia/NSW) $TZData(:Australia/Sydney).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.780732237583773
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq/xJjboFVAIgoXjbhvN2QWCCjsrQWCCjb/:SlSWB9IZaM3yIiFVAIgg2DCZrDCy
                                                                                                                                                                                                                          MD5:70EF2A87B4538500CFADB63B62DDCBC6
                                                                                                                                                                                                                          SHA1:8D737E6E8D37323D3B41AD419F1CA9B5991E2E99
                                                                                                                                                                                                                          SHA-256:59B67F2C7C62C5F9A93767898BA1B51315D2AC271075FAFC1A24313BB673FF27
                                                                                                                                                                                                                          SHA-512:E148FC32894A7138D1547910CBD590891120CE5FB533D1348243539C35CE2994DC9F3E7B6A952BF871882C8D6ECA47E13E08AF59AB52A55F790508F2DB9B0EB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Darwin)]} {. LoadTimeZoneFile Australia/Darwin.}.set TZData(:Australia/North) $TZData(:Australia/Darwin).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):714
                                                                                                                                                                                                                          Entropy (8bit):4.257489685002088
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp52wmdHCBdPmzKfkzm2z75izhNhaP0YqozBqmjj4zl5fV59Bhg8lfU:cQweCBpYd7IzrhaMYR8mP4znhf9U
                                                                                                                                                                                                                          MD5:B354B9525896FDED8769CF5140E76FFF
                                                                                                                                                                                                                          SHA1:8494E182E3803F2A6369261B4B4EAC184458ECC4
                                                                                                                                                                                                                          SHA-256:C14CAAD41E99709ABF50BD7F5B1DAFE630CA494602166F527DBDA7C134017FB0
                                                                                                                                                                                                                          SHA-512:717081F29FBACEE2722399DD627045B710C14CF6021E4F818B1768AF972061232412876872F113C468446D79A366D7FFD2E852563DC44A483761D78C7A16F74A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Perth) {. {-9223372036854775808 27804 0 LMT}. {-2337925404 28800 0 AWST}. {-1672559940 32400 1 AWDT}. {-1665385200 28800 0 AWST}. {-883634400 32400 1 AWDT}. {-876121200 28800 0 AWST}. {-860392800 32400 1 AWDT}. {-844671600 28800 0 AWST}. {-836470800 32400 0 AWST}. {152042400 32400 1 AWDT}. {162928800 28800 0 AWST}. {436298400 32400 1 AWDT}. {447184800 28800 0 AWST}. {690314400 32400 1 AWDT}. {699386400 28800 0 AWST}. {1165082400 32400 1 AWDT}. {1174759200 28800 0 AWST}. {1193508000 32400 1 AWDT}. {1206813600 28800 0 AWST}. {1224957600 32400 1 AWDT}. {1238263200 28800 0 AWST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):198
                                                                                                                                                                                                                          Entropy (8bit):4.75392731256171
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3yIaWhvFVAIgPWzCxL2DCoRWJvFBx+DC7W6:MBaIMjoTL2rOvFey
                                                                                                                                                                                                                          MD5:D12C6F15F8BFCA19FA402DAE16FC9529
                                                                                                                                                                                                                          SHA1:0869E6D11681D74CC3301F4538D98A225BE7C2E1
                                                                                                                                                                                                                          SHA-256:77EA0243A11D187C995CE8D83370C6682BC39D2C39809892A48251123FF19A1E
                                                                                                                                                                                                                          SHA-512:A98D1AF1FC3E849CCF9E9CC090D3C65B7104C164762F88B6048EA2802F17D635C2E66BE2661338C1DD604B550A267678245DE867451A1412C4C06411A21BE3A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Brisbane)]} {. LoadTimeZoneFile Australia/Brisbane.}.set TZData(:Australia/Queensland) $TZData(:Australia/Brisbane).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):4.701653352722385
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3yIDRpGvFVAIgSRFL2DCa7QDCuRpv:MBaIMjdp5YFL23QHpv
                                                                                                                                                                                                                          MD5:23671880AC24D35F231E2FCECC1A5E3A
                                                                                                                                                                                                                          SHA1:5EE2EFD5ADE268B5114EB02FDA77F4C5F507F3CB
                                                                                                                                                                                                                          SHA-256:9823032FFEB0BFCE50B6261A848FE0C07267E0846E9F7487AE812CEECB286446
                                                                                                                                                                                                                          SHA-512:E303C7DE927E7BAA10EE072D5308FEE6C4E9B2D69DDD8EF014ED60574E0855EE803FE19A7CB31587E62CAE894C087D47A91A130213A24FCCD152736D82F55AB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Adelaide)]} {. LoadTimeZoneFile Australia/Adelaide.}.set TZData(:Australia/South) $TZData(:Australia/Adelaide).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8066
                                                                                                                                                                                                                          Entropy (8bit):3.763781985138297
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:GZCiG+CiRyddsYtLhbVXd33cZF7bLaE9DTtM/m7eeYWlQOZIeVUF:GZCm2tLhbVXdnPQler
                                                                                                                                                                                                                          MD5:B3498EEA194DDF38C732269A47050CAA
                                                                                                                                                                                                                          SHA1:C32B703AA1FA34D890D151300A2B21E0FA8F55D3
                                                                                                                                                                                                                          SHA-256:0EE9BE0F0D6EC0CE10DEA1BE7A9F494C74B747418E966B85EC1FFB15F6F22A4F
                                                                                                                                                                                                                          SHA-512:A9419B797B1518AAEEE27A1796D0D024847F7A61D26238F1643EBD6131A6B36007FBABD9E766C3D4ED61B006FD31FC4555CB54B8681E7DBDEC26B38144D64BC9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Australia/Sydney) {. {-9223372036854775808 36292 0 LMT}. {-2364113092 36000 0 AEST}. {-1672567140 39600 1 AEDT}. {-1665392400 36000 0 AEST}. {-883641600 39600 1 AEDT}. {-876128400 36000 0 AEST}. {-860400000 39600 1 AEDT}. {-844678800 36000 0 AEST}. {-828345600 39600 1 AEDT}. {-813229200 36000 0 AEST}. {31500000 36000 0 AEST}. {57686400 39600 1 AEDT}. {67968000 36000 0 AEST}. {89136000 39600 1 AEDT}. {100022400 36000 0 AEST}. {120585600 39600 1 AEDT}. {131472000 36000 0 AEST}. {152035200 39600 1 AEDT}. {162921600 36000 0 AEST}. {183484800 39600 1 AEDT}. {194976000 36000 0 AEST}. {215539200 39600 1 AEDT}. {226425600 36000 0 AEST}. {246988800 39600 1 AEDT}. {257875200 36000 0 AEST}. {278438400 39600 1 AEDT}. {289324800 36000 0 AEST}. {309888000 39600 1 AEDT}. {320774400 36000 0 AEST}. {341337600 39600 1 AEDT}. {352224000 36000 0 AEST}. {3
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.7264864039237215
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq/xJjKD4YFedVAIgoXjKgVAt2QWCCjiiieQWCCjKDvn:SlSWB9IZaM3yI4DVyVAIgxkAt2DC3ne0
                                                                                                                                                                                                                          MD5:C7C9CDC9EC855D2F0C23673FA0BAFFB6
                                                                                                                                                                                                                          SHA1:4C79E1C17F418CEE4BE8F638F34201EE843D8E28
                                                                                                                                                                                                                          SHA-256:014B3D71CE6BD77AD653047CF185EA03C870D78196A236693D7610FED7F30B6F
                                                                                                                                                                                                                          SHA-512:79AE11CE076BFB87C0AAD35E9AF6E760FC592F1D086EB78E6DF88744F502ED4248853A0EAD72ADA8EA9583161925802EE5E46E3AA8CE8CF873852C26B4FDC05B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Hobart)]} {. LoadTimeZoneFile Australia/Hobart.}.set TZData(:Australia/Tasmania) $TZData(:Australia/Hobart).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199
                                                                                                                                                                                                                          Entropy (8bit):4.7697171393457936
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3yIvFfkvFVAIgoFFL2DCzyQDCMFB:MBaIMj9fHaFL2xQzB
                                                                                                                                                                                                                          MD5:BD2EA272B8DF472E29B7DD0506287E92
                                                                                                                                                                                                                          SHA1:55BF3A3B6398F9FF1DB3A46998A4EFF44F6F325C
                                                                                                                                                                                                                          SHA-256:EE35DF8BBCD6A99A5550F67F265044529BD7AF6A83087DD73CA0BE1EE5C8BF51
                                                                                                                                                                                                                          SHA-512:82B18D2C9BA7113C2714DC79A87101FFB0C36E5520D61ADEAB8A31AD219E51A6402A6C8A8FD7120A330FE8847FF8F083397A1BF5889B73484FBAA6F99497DE48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Melbourne)]} {. LoadTimeZoneFile Australia/Melbourne.}.set TZData(:Australia/Victoria) $TZData(:Australia/Melbourne).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.781808870279912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq/xJjXFedVAIgoXjbOAt2QWCCjH0QWCCj5:SlSWB9IZaM3yIYVAIg9At2DC00DCa
                                                                                                                                                                                                                          MD5:9E0EF0058DDA86016547F2BFE421DE74
                                                                                                                                                                                                                          SHA1:5DB6AEAC6B0A42FEAE28BB1A45679BC235F4E5BF
                                                                                                                                                                                                                          SHA-256:FC952BE48F11362981CDC8859F9C634312E5805F2F1513159F25AEFCE664867C
                                                                                                                                                                                                                          SHA-512:C60E5A63378F8424CE8D862A575DFE138646D5E88C6A34562A77BEC4B34EA3ED3085424E2130E610197164C7E88805DC6CDE46416EB45DC256F387F632F48CA7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Perth)]} {. LoadTimeZoneFile Australia/Perth.}.set TZData(:Australia/West) $TZData(:Australia/Perth).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):207
                                                                                                                                                                                                                          Entropy (8bit):4.871861105493913
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3yIcKCFVAIgJKfF2DCkuM0DC9Kl:MBaIMjcKCQJKt2kVSKl
                                                                                                                                                                                                                          MD5:5C3CED24741704A0A7019FA66AC0C0A1
                                                                                                                                                                                                                          SHA1:88C7AF3B22ED01ED99784C3FAB4F5112AA4659F3
                                                                                                                                                                                                                          SHA-256:71A56C71CC30A46950B1B4D4FBB12CB1CBAA24267F994A0F223AE879F1BB6EEC
                                                                                                                                                                                                                          SHA-512:771A7AC5D03DD7099F565D6E926F7B97E8A7BA3795339D3FD78F7C465005B55388D8CC30A62978042C354254E1BA5467D0832C0D29497E33D6EF1DA217528806
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Australia/Broken_Hill)]} {. LoadTimeZoneFile Australia/Broken_Hill.}.set TZData(:Australia/Yancowinna) $TZData(:Australia/Broken_Hill).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):4.84045343046357
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0sMhS4edVAIg20sMhStQ1bNW1h4IAcGEsMhSA:SlSWB9IZaM3y7thtedVAIgpthKQxWh4y
                                                                                                                                                                                                                          MD5:DF4D752BEEAF40F081C03B4572E9D858
                                                                                                                                                                                                                          SHA1:A83B5E4C3A9EB0CF43263AFF65DB374353F65595
                                                                                                                                                                                                                          SHA-256:1B1AD73D3FE403AA1F939F05F613F6A3F39A8BA49543992D836CD6ED14B92F2C
                                                                                                                                                                                                                          SHA-512:1F96F1D8AACD6D37AC13295B345E761204DAE6AA1DF4894A11E00857CCB7247FA7BEBD22407EA5D13193E2945EB1F4210E32669069F157F1459B26643A67F445
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Rio_Branco)]} {. LoadTimeZoneFile America/Rio_Branco.}.set TZData(:Brazil/Acre) $TZData(:America/Rio_Branco).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.826795532956443
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0wKy4oedVAIg20wK+F1bIAJl0IAcGEwKyvn:SlSWB9IZaM3y7/rDdVAIgp/mxIAE90/8
                                                                                                                                                                                                                          MD5:86B9E49F604AD5DBC4EC6BA735A513C7
                                                                                                                                                                                                                          SHA1:BE3AB32339DF9830D4F445CCF883D79DDBA8708E
                                                                                                                                                                                                                          SHA-256:628A9AE97682B98145588E356948996EAE18528E34A1428A6B2765CCAA7A8A1F
                                                                                                                                                                                                                          SHA-512:EE312624EC0193C599B2BDBFA57CC4EA7C68890955E0D888149172DF8F2095C553BFBB80BF76C1B8F3232F3A5863A519FF59976BBAEA622C64737890D159AA22
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Noronha)]} {. LoadTimeZoneFile America/Noronha.}.set TZData(:Brazil/DeNoronha) $TZData(:America/Noronha).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):4.9019570219911275
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0tQJXvedVAIg20tQJX1bJHIAcGEtQJXv:SlSWB9IZaM3y7tIGdVAIgptExR90tIv
                                                                                                                                                                                                                          MD5:FBF6B9E8B9C93B1B9E484D88EF208F38
                                                                                                                                                                                                                          SHA1:44004E19A485B70E003687CB1057B8A2421D1BF0
                                                                                                                                                                                                                          SHA-256:C89E831C4A0525C3CEFF17072843386369096C08878A4412FB208EF5D3F156D8
                                                                                                                                                                                                                          SHA-512:4E518FC4CED0C756FF45E0EDE72F6503C4B3AE72E785651DE261D3F261D43F914721EFCEAB272398BC145E41827F35D46DE4E022EAF413D95F64E8B3BD752002
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Sao_Paulo)]} {. LoadTimeZoneFile America/Sao_Paulo.}.set TZData(:Brazil/East) $TZData(:America/Sao_Paulo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.853909262702622
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0znQZFwFVAIg20znQoCxL1bbAWVIAcGEznQb:SlSWB9IZaM3y7zn+wFVAIgpznzCxLxnJ
                                                                                                                                                                                                                          MD5:116F0F146B004D476B6B86EC0EE2D54D
                                                                                                                                                                                                                          SHA1:1F39A84EF3DFF676A844174D9045BE388D3BA8C0
                                                                                                                                                                                                                          SHA-256:F24B9ED1FAFA98CD7807FFFEF4BACA1BCE1655ABD70EB69D46478732FA0DA573
                                                                                                                                                                                                                          SHA-512:23BD7EC1B5ADB465A204AAA35024EE917F8D6C3136C4EA973D8B18B586282C4806329CEBE0EDBF9E13D0032063C8082EC0D84A049F1217C856943A4DDC4900D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Manaus)]} {. LoadTimeZoneFile America/Manaus.}.set TZData(:Brazil/West) $TZData(:America/Manaus).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7471
                                                                                                                                                                                                                          Entropy (8bit):3.710275786382764
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ht6CvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:PSTRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:AE72690EF7063F0B9F640096204E2ECE
                                                                                                                                                                                                                          SHA1:4F815B51DA9BCA97DFF71D191B74D0190890F946
                                                                                                                                                                                                                          SHA-256:BB2C5E587EE9F9BF85C1D0B6F57197985663D4DFF0FED13233953C1807A1F11C
                                                                                                                                                                                                                          SHA-512:F7F0911251BC7191754AF0BA2C455E825BF16EA9202A740DC1E07317B1D74CDAF680E161155CC1BD5E862DCEE2A58101F419D8B5E0E24C4BA7134999D9B55C48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:CET) {. {-9223372036854775808 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766623600 3600 0 CET}. {228877200 7200 1 CEST}. {243997200 3600 0 CET}. {260326800 7200 1 CEST}. {276051600 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8227
                                                                                                                                                                                                                          Entropy (8bit):3.723597525146651
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:KxrIOdXkqbfkeTzZSJw5/9/yuvQ+hcrD57X0N41+IestuNEbYkzbXwDTIRqfhXbo:KxrIOdXkqbfNTzZSJw5/9/yuvQ6crD5r
                                                                                                                                                                                                                          MD5:B5AC3FA83585957217CA04384171F0FF
                                                                                                                                                                                                                          SHA1:827FF1FBDADDDE3754453E680B4E719A50499AE6
                                                                                                                                                                                                                          SHA-256:17CBE2F211973F827E0D5F9F2B4365951164BC06DA065F6F38F45CB064B29457
                                                                                                                                                                                                                          SHA-512:A56485813C47758F988A250FFA97E2DBD7A69DDD16034E9EF2834AF895E8A374EEB4DA3F36E6AD80285AC10F84543ECF5840670805082E238F822F85D635651F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:CST6CDT) {. {-9223372036854775808 -21600 0 CST}. {-1633276800 -18000 1 CDT}. {-1615136400 -21600 0 CST}. {-1601827200 -18000 1 CDT}. {-1583686800 -21600 0 CST}. {-880214400 -18000 1 CWT}. {-769395600 -18000 1 CPT}. {-765392400 -21600 0 CST}. {-84384000 -18000 1 CDT}. {-68662800 -21600 0 CST}. {-52934400 -18000 1 CDT}. {-37213200 -21600 0 CST}. {-21484800 -18000 1 CDT}. {-5763600 -21600 0 CST}. {9964800 -18000 1 CDT}. {25686000 -21600 0 CST}. {41414400 -18000 1 CDT}. {57740400 -21600 0 CST}. {73468800 -18000 1 CDT}. {89190000 -21600 0 CST}. {104918400 -18000 1 CDT}. {120639600 -21600 0 CST}. {126691200 -18000 1 CDT}. {152089200 -21600 0 CST}. {162374400 -18000 1 CDT}. {183538800 -21600 0 CST}. {199267200 -18000 1 CDT}. {215593200 -21600 0 CST}. {230716800 -18000 1 CDT}. {247042800 -21600 0 CST}. {262771200 -18000 1 CDT}. {278492400 -216
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.754307292225081
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx02NEO4FVAIg202NEtYF0nalGe2IAcGE2NEOv:SlSWB9IZaM3y7UEO4FVAIgpUEqF0af2b
                                                                                                                                                                                                                          MD5:B0E220B9CD16038AAF3EA21D60064B62
                                                                                                                                                                                                                          SHA1:333410CB7D4F96EF836CDC8097A1DCE34A2B961A
                                                                                                                                                                                                                          SHA-256:6F71D7ED827C9EF6E758A44D2A998673E1225EB8005AD557A1713F5894833F92
                                                                                                                                                                                                                          SHA-512:F879F60E36C739280E8FC255D2792BB24BCA90A265F8F90B5FB85630D5A58CE4FDBD24EA5594924375C3CD31DBC6D49C06CBFA43C52D0B9A1E9D799914A164F7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:Canada/Atlantic) $TZData(:America/Halifax).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):4.814426408072182
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0po4FVAIg20peRL0nPQox/h4IAcGEpov:SlSWB9IZaM3y7phFVAIgppOL0d490py
                                                                                                                                                                                                                          MD5:8374E381BC8235B11B7C5CA215FA112C
                                                                                                                                                                                                                          SHA1:181298556253D634B09D72BD925C4DBB92055A06
                                                                                                                                                                                                                          SHA-256:1B87273B264A3243D2025B1CFC05B0797CBC4AA95D3319EEE2BEF8A09FDA8CAD
                                                                                                                                                                                                                          SHA-512:12800E49B8094843F66454E270B4BE154B053E5FB453C83269AF7C27B965071C88B02AF7BB404E7F5A07277DB45E58D1C5240B377FC06172087BB29749C7543B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Winnipeg)]} {. LoadTimeZoneFile America/Winnipeg.}.set TZData(:Canada/Central) $TZData(:America/Winnipeg).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.860347334610986
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nbP2/8S64IAcGEsAz1:SlSWB9IZaM3y7hzipVAIgphzGCW60L5X
                                                                                                                                                                                                                          MD5:F5CB42BC029315088FAD03C9235FFB51
                                                                                                                                                                                                                          SHA1:7773ECE0B85D66E4FA207A26EE4395F38BAC4068
                                                                                                                                                                                                                          SHA-256:AF04A4558E31C9864B92FE3403011F7A2FBD837E1314A7BB5AF552D5AED06457
                                                                                                                                                                                                                          SHA-512:0533B9D98834866FAA3C6E67A6F61A8A22C2BFDBA8C5336388C0894FBA550611C9112515F17E20E7B3508EC2318D58EA7CA814EC10C3451954C3CC169EDA0F8C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/East-Saskatchewan) $TZData(:America/Regina).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.7067203041014185
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0qMKLRXIVAIg20qMKLRI60nbHboxp4IAcGEqMKLRXv:SlSWB9IZaM3y7RQ+VAIgpRQ+60Dboxp2
                                                                                                                                                                                                                          MD5:22453AC70F84F34868B442E0A7BDC20A
                                                                                                                                                                                                                          SHA1:730049FF6953E186C197601B27AB850305961FD0
                                                                                                                                                                                                                          SHA-256:545B992E943A32210F768CB86DEF3203BE956EE03A3B1BC0D55A5CD18A4F064D
                                                                                                                                                                                                                          SHA-512:91FE33FAD3954019F632A771BCBD9FF3FDCCDA1F51DD25E0E5808A724F2D9B905E5E2DEE32D415BEA9A9ADB74186D83548584414BB130DF1A166D49373AC7BEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Toronto)]} {. LoadTimeZoneFile America/Toronto.}.set TZData(:Canada/Eastern) $TZData(:America/Toronto).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.768148288986999
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx07nKL5zFVAIg207nKLKN0nNYLo/4IAcGE7nKLun:SlSWB9IZaM3y77GzFVAIgp7DN0W8/49s
                                                                                                                                                                                                                          MD5:5E0D3D1A7E9F800210BB3E02DFF2ECD3
                                                                                                                                                                                                                          SHA1:F2471795A9314A292DEAA3F3B94145D3DE5A2792
                                                                                                                                                                                                                          SHA-256:A8B3A4D53AA1CC73312E80951A9E9CEA162F4F51DA29B897FEB58B2DF3431821
                                                                                                                                                                                                                          SHA-512:F80C7CDFE20E5FAD9E4BA457446F067ACE0C3F4659761E3B4A2422D3456CDE92C20589954DE5E0DC64619E3B6AB3A55AE0E0E783F8EFB24D74A5F6DFBF5ABB16
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Edmonton)]} {. LoadTimeZoneFile America/Edmonton.}.set TZData(:Canada/Mountain) $TZData(:America/Edmonton).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191
                                                                                                                                                                                                                          Entropy (8bit):4.953647576523321
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0tVZMYFwFVAIg20tVZoYvxL0nJBJi6FBx/2IAcGEt3:SlSWB9IZaM3y7tgYmFVAIgptMqL0xdB7
                                                                                                                                                                                                                          MD5:3A4E193C8624AE282739867B22B7270A
                                                                                                                                                                                                                          SHA1:AC93EEDA7E8AB7E40834FFBA83BAE5D803CB7162
                                                                                                                                                                                                                          SHA-256:70EF849809F72741FA4F37C04C102A8C6733639E905B4E7F554F1D94737BF26B
                                                                                                                                                                                                                          SHA-512:BE2AACEE2A6F74520F4F1C0CCBBB750ED6C7375D4368023BAB419184F8F717D52981106C03F487B24A943907E60784136C0E5F8C1D5B3D1C67C20E23A4F412B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/St_Johns)]} {. LoadTimeZoneFile America/St_Johns.}.set TZData(:Canada/Newfoundland) $TZData(:America/St_Johns).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):4.839589386398345
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0oELSTAWFwVAIg20oELSTAQO0L0nie2IAcGEoELSTH:SlSWB9IZaM3y7ZLgXwVAIgpZLgJJL0Nu
                                                                                                                                                                                                                          MD5:6AA0FCE594E991D6772C04E137C7BE00
                                                                                                                                                                                                                          SHA1:6C53EE6FEBEC2BD5271DD80D40146247E779CB7B
                                                                                                                                                                                                                          SHA-256:D2858621DA914C3F853E399F0819BA05BDE68848E78F59695B84B2B83C1FDD2A
                                                                                                                                                                                                                          SHA-512:7B354BB9370BB61EB0E801A1477815865FDE51E6EA43BF166A6B1EED127488CC25106DEE1C6C5DC1EF3E13E9819451E10AFBC0E189D3D3CDE8AFFA4334C77CA3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Vancouver)]} {. LoadTimeZoneFile America/Vancouver.}.set TZData(:Canada/Pacific) $TZData(:America/Vancouver).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.83938055689947
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW60nogS64IAcGEsAzEun:SlSWB9IZaM3y7hzipVAIgphzGCW60Hd9
                                                                                                                                                                                                                          MD5:927FD3986F83A60C217A3006F65A3B0A
                                                                                                                                                                                                                          SHA1:022D118024BFC5AE0922A1385288C3E4B41903DB
                                                                                                                                                                                                                          SHA-256:BB457E954DB625A8606DD0F372DA9BFFAA01F774B4B82A2B1CEE2E969C15ABC3
                                                                                                                                                                                                                          SHA-512:3EA932FA5416A9C817977F9D31C8A15C937A453B4D6A6409A7966E76D66A685C91F1117C82BEBEBA2AF5516556DA2BDEC898AD718C78FB8B690F31692174DA6C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:Canada/Saskatchewan) $TZData(:America/Regina).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):4.841592909599599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0peR2pVkvFVAIg20peR2zxL0nTOK8x/h4IAcGEpeRu:SlSWB9IZaM3y7peR2fkvFVAIgppeR2FF
                                                                                                                                                                                                                          MD5:9F2A7F0D8492F67F764F647638533C3F
                                                                                                                                                                                                                          SHA1:3785DACD1645E0630649E411DC834E8A4FB7F40B
                                                                                                                                                                                                                          SHA-256:F2A81B7E95D49CEC3C8952463B727129B4DC43D58ADC64BB7CAB642D3D191039
                                                                                                                                                                                                                          SHA-512:0133870BB96851ECD486D55FD10EB4BCB1678772C1BFFADE85FC5644AC8445CDB4C6284BEFFED197E9386C9C6EF74F5F718F2CB43C4C7B8E65FE413C8EC51CD0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Whitehorse)]} {. LoadTimeZoneFile America/Whitehorse.}.set TZData(:Canada/Yukon) $TZData(:America/Whitehorse).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):4.762021566751952
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0tfEJ5YyVAIg20tfEJvYvWAt0dKLRMyREGH/h4IAcB:SlSWB9IZaM3y7tfEJHVAIgptfEJAvN0+
                                                                                                                                                                                                                          MD5:B2BDB6C027FF34D624EA8B992E5F41AB
                                                                                                                                                                                                                          SHA1:425AB0D603C3F5810047A7DC8FD28FDF306CC2DB
                                                                                                                                                                                                                          SHA-256:F2E3C1E88C5D165E1D38B0D2766D64AA4D2E6996DF1BE58DADC9C4FC4F503A2E
                                                                                                                                                                                                                          SHA-512:6E5A8DC6F5D5F0218C37EE719441EBDC7EDED3708F8705A98AEF7E256C8DC5D82F4BF82C529282E01D8E6E669C4F843B143730AD9D8BBF43BCC98ECB65B52C9B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Santiago)]} {. LoadTimeZoneFile America/Santiago.}.set TZData(:Chile/Continental) $TZData(:America/Santiago).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.758503564906338
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG7ZAJpVAIgObT7ZA6xL0bxOdBx/nUDH7ZAen:SlSWB9IZaM3ycJA3VAIgObJA6xL04dB4
                                                                                                                                                                                                                          MD5:E9DF5E3D9E5E242A1B9C73D8F35C9911
                                                                                                                                                                                                                          SHA1:9905EF3C1847CFF8156EC745779FCF0D920199B7
                                                                                                                                                                                                                          SHA-256:AA305BEC168C0A5C8494B81114D69C61A0D3CF748995AF5CCC3E2591AC78C90C
                                                                                                                                                                                                                          SHA-512:7707AC84D5C305F40A1713F1CBBED8A223553A5F989281CCDB278F0BD0D408E6FC9396D9FA0CCC82168248A30362D2D4B27EDEF36D9A3D70E286A5B668686FDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Easter)]} {. LoadTimeZoneFile Pacific/Easter.}.set TZData(:Chile/EasterIsland) $TZData(:Pacific/Easter).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):170
                                                                                                                                                                                                                          Entropy (8bit):4.8073098952422395
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx02TEMVFwVAIg202TEKN0lIAcGE2TEMv:SlSWB9IZaM3y76EHVAIgp6EKN0l906Eu
                                                                                                                                                                                                                          MD5:BA8EE8511A2013E791A3C50369488588
                                                                                                                                                                                                                          SHA1:03BF30F56FB604480A9F5ECD8FB13E3CF82F4524
                                                                                                                                                                                                                          SHA-256:2F9DFE275B62EFBCD5F72D6A13C6BB9AFD2F67FDDD8843013D128D55373CD677
                                                                                                                                                                                                                          SHA-512:29C9E9F4B9679AFD688A90A605CFC1D7B86514C4966E2196A4A5D48D4F1CF16775DFBDF1C9793C3BDAA13B6986765531B2E11398EFE5662EEDA7B37110697832
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Havana)]} {. LoadTimeZoneFile America/Havana.}.set TZData(:Cuba) $TZData(:America/Havana).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7189
                                                                                                                                                                                                                          Entropy (8bit):3.6040923024580884
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:WB8kMKVCy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lf:AroXPzh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:9AE4C7EC014649393D354B02DF00F8B9
                                                                                                                                                                                                                          SHA1:D82195DEF49CFFEAB3791EA70E6D1BB8BC113155
                                                                                                                                                                                                                          SHA-256:4CB6582052BE7784DD08CE7FD97ACC56234F07BCF80B69E57111A8F88454908E
                                                                                                                                                                                                                          SHA-512:6F0C138AF98A4D4A1028487C29267088BD4C0EC9E7C1DB9818FA31A61C9584B67B3F5909C6E6FDB0F7183629E892A77BA97654D39FCE7DDEF6908F8146B7BE72
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:EET) {. {-9223372036854775808 7200 0 EET}. {228877200 10800 1 EEST}. {243997200 7200 0 EET}. {260326800 10800 1 EEST}. {276051600 7200 0 EET}. {291776400 10800 1 EEST}. {307501200 7200 0 EET}. {323830800 10800 1 EEST}. {338950800 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):4.879680803636454
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yLWkXGm2OHLVvain:SlSWB9X5y2m2OHLViin
                                                                                                                                                                                                                          MD5:33221E0807873CC5E16A55BF4450B6D4
                                                                                                                                                                                                                          SHA1:A01FD9D1B8E554EE7A25473C2FBECA3B08B7FD02
                                                                                                                                                                                                                          SHA-256:5AA7D9865554BCE546F1846935C5F68C9CA806B29B6A45765BA55E09B14363E4
                                                                                                                                                                                                                          SHA-512:54A33B239BBFCFC645409FBC8D9DDBFCAE56067FA0427D0BE5F49CB32EB8EEC8E43FC22CE1C083FDC17DD8591BE9DB28A2D5006AFA473F10FB17EF2CE7AED305
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:EST) {. {-9223372036854775808 -18000 0 EST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8227
                                                                                                                                                                                                                          Entropy (8bit):3.723178863172678
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:W4UwdaC3Xm8sHRwvOTFhP5S+ijFnRaJeaX1eyDt:Cwdrn+qvOTFhPI1jFIL
                                                                                                                                                                                                                          MD5:1A7BDED5B0BADD36F76E1971562B3D3B
                                                                                                                                                                                                                          SHA1:CF5BB82484C4522B178E25D14A42B3DBE02D987D
                                                                                                                                                                                                                          SHA-256:AFD2F12E50370610EA61BA9DD3838129785DFDEE1EBCC4E37621B54A4CF2AE3F
                                                                                                                                                                                                                          SHA-512:4803A906E2C18A2792BF812B8D26C936C71D8A9DD9E87F7DA06630978FCB5DE1094CD20458D37973AA9967D51B97F94A5785B7B15F807E526C13D018688F16D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:EST5EDT) {. {-9223372036854775808 -18000 0 EST}. {-1633280400 -14400 1 EDT}. {-1615140000 -18000 0 EST}. {-1601830800 -14400 1 EDT}. {-1583690400 -18000 0 EST}. {-880218000 -14400 1 EWT}. {-769395600 -14400 1 EPT}. {-765396000 -18000 0 EST}. {-84387600 -14400 1 EDT}. {-68666400 -18000 0 EST}. {-52938000 -14400 1 EDT}. {-37216800 -18000 0 EST}. {-21488400 -14400 1 EDT}. {-5767200 -18000 0 EST}. {9961200 -14400 1 EDT}. {25682400 -18000 0 EST}. {41410800 -14400 1 EDT}. {57736800 -18000 0 EST}. {73465200 -14400 1 EDT}. {89186400 -18000 0 EST}. {104914800 -14400 1 EDT}. {120636000 -18000 0 EST}. {126687600 -14400 1 EDT}. {152085600 -18000 0 EST}. {162370800 -14400 1 EDT}. {183535200 -18000 0 EST}. {199263600 -14400 1 EDT}. {215589600 -18000 0 EST}. {230713200 -14400 1 EDT}. {247039200 -18000 0 EST}. {262767600 -14400 1 EDT}. {278488800 -180
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):165
                                                                                                                                                                                                                          Entropy (8bit):4.812476042768195
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsPHVyVAIgNGE7JW6yCh0DcPHv:SlSWB9IZaM3y7AVAIgNTFW6yg0DY
                                                                                                                                                                                                                          MD5:3708D7ED7044DE74B8BE5EBD7314371B
                                                                                                                                                                                                                          SHA1:5DDC75C6204D1A2A59C8441A8CAF609404472895
                                                                                                                                                                                                                          SHA-256:07F4B09FA0A1D0BA63E17AD682CAD9535592B372815AB8FD4884ACD92EC3D434
                                                                                                                                                                                                                          SHA-512:A8761601CD9B601E0CE8AC35B6C7F02A56B07DC8DE31DEB99F60CB3013DEAD900C74702031B5F5F9C2738BA48A8420603D46C3AE0E0C87D40B9D9D44CE0EAE81
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Cairo)]} {. LoadTimeZoneFile Africa/Cairo.}.set TZData(:Egypt) $TZData(:Africa/Cairo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):167
                                                                                                                                                                                                                          Entropy (8bit):4.85316662399069
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV5QH+owFVAIgoq6QH7W6yMQs/h8QanQHpn:SlSWB9IZaM3ymnQeowFVAIgonQbNyM/R
                                                                                                                                                                                                                          MD5:AA0DEB998177EB5208C4D207D46ECCE3
                                                                                                                                                                                                                          SHA1:DD8C7CE874EE12DD77F467B74A9C8FC74C7045FF
                                                                                                                                                                                                                          SHA-256:16A42F07DE5233599866ECC1CBB1FC4CD4483AC64E286387A0EED1AFF919717D
                                                                                                                                                                                                                          SHA-512:D93A66A62304D1732412CAAAB2F86CE5BCD07D07C1315714D81754827D5EFD30E36D06C0DC3CF4A8C86B750D7D6A144D609D05E241FADC7FF78D3DD2044E4CBB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Dublin)]} {. LoadTimeZoneFile Europe/Dublin.}.set TZData(:Eire) $TZData(:Europe/Dublin).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                                                                          Entropy (8bit):4.883978227144926
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDMWkXGm2OHvDd:SlSWB9X5yRQCm2OHB
                                                                                                                                                                                                                          MD5:94CDB0947C94E40D59CB9E56DB1FA435
                                                                                                                                                                                                                          SHA1:B73907DAC08787D3859093E8F09828229EBAA6FD
                                                                                                                                                                                                                          SHA-256:17AF31BD69C0048A0787BA588AD8641F1DC000A8C7AEC66386B0D9F80417ABBF
                                                                                                                                                                                                                          SHA-512:5F47A2864F9036F3FD61FC65ED4969330DD2A1AC237CB2BD8E972DDFED75120D8D377D5C84060015DCFC163D03F384DC56DC8C6F29E65528C04F1FDA8BBC688E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT) {. {-9223372036854775808 0 0 GMT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):4.862090278972909
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDOm7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRSw8RQvn
                                                                                                                                                                                                                          MD5:4AC2027A430A7343B74393C7FE1D6285
                                                                                                                                                                                                                          SHA1:C675A91954EC82EB67E1B7FA4B0C0ED11AAF83DA
                                                                                                                                                                                                                          SHA-256:01EEF5F81290DBA38366D8BEADAD156AAC40D049DBFA5B4D0E6A6A8641D798D1
                                                                                                                                                                                                                          SHA-512:61943A348C4D133B0730EAA264A15EF37E0BBE2F767D87574801EAAA9A457DA48D854308B6ABADA21D33F4D498EB748BCB66964EB14BB8DC1367F77A803BA520
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT+0) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.936955816757987
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOvedSXGm2OH1VOY:SlSWB9X5yRSvwJm2OH1VOY
                                                                                                                                                                                                                          MD5:B8D9D5AF8CE887722F92207393F93481
                                                                                                                                                                                                                          SHA1:3F33F97F96AE9C30A616B8A84888B032A3E1A59A
                                                                                                                                                                                                                          SHA-256:049ABD0DCEC9C4128FF6F5BBB1F1D64F53AB7E4A1BD07D0650B0B67D1F581C64
                                                                                                                                                                                                                          SHA-512:7A10D28DA75FCBF5AF43FEECB91801E97CB161A6909E9463A2F1218323EE3B4ECA10E11438D20E876B6EF912E21D26264FFBD04C75D702D2386A4E959EB5FFAC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+1) {. {-9223372036854775808 -3600 0 -01}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):113
                                                                                                                                                                                                                          Entropy (8bit):4.92045957745591
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOgFkXGm2OH1VYU8Cn:SlSWB9X5yRS0m2OH1VYQn
                                                                                                                                                                                                                          MD5:33022DF11BC5459AA1DD968CEF24EA03
                                                                                                                                                                                                                          SHA1:45DE6AD3B142C1768B410C047DFD45444E307AB8
                                                                                                                                                                                                                          SHA-256:15F72B4F2C04EDDC778AAD999B5A329F55F0D10AC141862488D2DCE520541A85
                                                                                                                                                                                                                          SHA-512:0C13040965135D199A29CFE8E1598AA8E840B141B85CCF1A45611B367AF046107FDA8478B1779E2AC665534DC4E84630267B42F902DB3A2CB78DD6D20939010E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+10) {. {-9223372036854775808 -36000 0 -10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):113
                                                                                                                                                                                                                          Entropy (8bit):4.959312316620187
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOeLXGm2OHaBBKn:SlSWB9X5yRShm2OHa7Kn
                                                                                                                                                                                                                          MD5:5FC01E15A719B73A5AA5B0A6E7F16B0C
                                                                                                                                                                                                                          SHA1:E1AAEF7C52DF944A9AEDCC74E6A07FABE09BAFCE
                                                                                                                                                                                                                          SHA-256:69A82F9EB9E120FABFA88C846BC836B85A08FFF4B304914256E6C3A72CB371D0
                                                                                                                                                                                                                          SHA-512:86659001C159730C012C385D505CD822F5CE6E59C0BD7899F90070372A56D348F0292F74C34A4E960E721D113DB5F65751A513D7C1A3CFBF09CBA22118323DED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+11) {. {-9223372036854775808 -39600 0 -11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):113
                                                                                                                                                                                                                          Entropy (8bit):4.934932781202811
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOK/kXGm2OH3FNyU7n:SlSWB9X5yRSKTm2OH3Xyan
                                                                                                                                                                                                                          MD5:BEE0C510C41F541B4E919183459488B2
                                                                                                                                                                                                                          SHA1:DA028394973155C52EDDDB4EB4CCACA7F3A74188
                                                                                                                                                                                                                          SHA-256:3B3DA9CF6FEB6E90772E9EC391D857D060A2F52A34191C3A0472794FEC421F5F
                                                                                                                                                                                                                          SHA-512:9EBE1FAD2B47DDA627F52F97094556F3A8C0D03BF2DD4C12CC8611BD2D59FE3A2C1016FFBDF0B95F2C5C56D81C8B2020EBF1D2AB4AAAFE33AB5469AFE1C596A1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+12) {. {-9223372036854775808 -43200 0 -12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.876100974396153
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOcFwFFkXGm2OHnFQVIK:SlSWB9X5yRS0wTm2OHnFQV7
                                                                                                                                                                                                                          MD5:316ED84A4318F8641592A0959395EFA3
                                                                                                                                                                                                                          SHA1:970C97E6F433524BE88031098DD4F5F479FB4AA6
                                                                                                                                                                                                                          SHA-256:8323CA90E2902CAAD2EBCFFBF681FC3661424AE5B179140581AA768E36639C93
                                                                                                                                                                                                                          SHA-512:6DD62C72E24A24F8FCD8EC085942920A04A55DD03D54C712ADA2BE0EDD6166F34A1229E045C50384808735C40CF72B98458E0329B9762B4B3E95E7ACABB0017E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+2) {. {-9223372036854775808 -7200 0 -02}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.904010922708719
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOCcXGm2OHBFVGHC:SlSWB9X5yRSCTm2OHBFAHC
                                                                                                                                                                                                                          MD5:899F1AAB147D5A13D7E22CBE374F3F8D
                                                                                                                                                                                                                          SHA1:C132B5E0859EB6C95C64D50408D4A310893D1E8F
                                                                                                                                                                                                                          SHA-256:3C2EF9B7218D133E7611527CE1CD5F03FF6FED5DE245F082FF21F4571A7D9EA4
                                                                                                                                                                                                                          SHA-512:63C8F98BAE437BB9717A3D13C70424FBB43CBA392A1750DE8EAB31C825F190C5DE1987B391591361F80CE084896B838BE78CBE56C1E1C4DC0A1A6D280742FD91
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+3) {. {-9223372036854775808 -10800 0 -03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.92751033740291
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOqLXGm2OHBvG9:SlSWB9X5yRStm2OHBO9
                                                                                                                                                                                                                          MD5:9D050C35FCDFD703C387CF2065E6250B
                                                                                                                                                                                                                          SHA1:EEE8A277CB49D03085A5C6FCEA94961790D23339
                                                                                                                                                                                                                          SHA-256:B43B685B6B168FD964590BC6C4264511155DB76EBCB7A5BCB20C35C0AD9B8CC4
                                                                                                                                                                                                                          SHA-512:D56449C34A7F63DCCE79F4A6C4731454BB909C6DA49593FFE6B59DD3DE755720931BFD245A799B7FB1397FC0AE0AF89E88AD4DAA91AB815740328B27D301DCDE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+4) {. {-9223372036854775808 -14400 0 -04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.911642645675445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOEkXGm2OHLVvyV9C:SlSWB9X5yRSQm2OHLVKV9C
                                                                                                                                                                                                                          MD5:81856E9473F48AB0F53B09CB6BEF61B1
                                                                                                                                                                                                                          SHA1:52A906EE5B706091E407CA8A0D036A46727790EA
                                                                                                                                                                                                                          SHA-256:B0224DBA144B1FE360E2922B1E558E79F6960A173045DE2A1EDACDC3F24A3E36
                                                                                                                                                                                                                          SHA-512:7C9679A2C299741E98FF1E759313D1CDC050B73B7E4FB097FF3186B4C35271C203D54E12D758675639A3D3F3F1EB43D768834B9CE7D22376BEA71FB0ACF164A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+5) {. {-9223372036854775808 -18000 0 -05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.930765051479699
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOAkEXGm2OHvTmUK:SlSWB9X5yRSbLm2OHvin
                                                                                                                                                                                                                          MD5:757E578CE6FCD34966D9FF90D9F9A7BF
                                                                                                                                                                                                                          SHA1:091E3FC890BF7A4C61CF6558F7984FD41F61803B
                                                                                                                                                                                                                          SHA-256:28F4E6F7FDE80AE412D364D33A1714826F9F53FF980D2926D13229B691978979
                                                                                                                                                                                                                          SHA-512:442FEBA01108124692A0F76ACA4868D5B7754C3527B9301AC0271DD5A379AF3675CE40B6C017310856D4CE700E3171B5EEA5EF89D5F8432EC3D6D27F48F2EEE8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+6) {. {-9223372036854775808 -21600 0 -06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.884164328721898
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDONedFkXGm2OHrXVYVe:SlSWB9X5yRSNwJm2OHriVe
                                                                                                                                                                                                                          MD5:723CE2E217F73927FE030E4E004C68B5
                                                                                                                                                                                                                          SHA1:40E46C8F3631298C3FFBF0DDC72E48E13A42A3F4
                                                                                                                                                                                                                          SHA-256:2D2B6A351501CB1023F45CE9B16B759D8971E45C2B8E1348A6935707925F0280
                                                                                                                                                                                                                          SHA-512:25E1C37047CD2411B6F986F30EC54B53A3D3841FD275D05732A0DF6C0718981F2343CEE77E241F347030244B22EC4A23FDEE077EB4D18BC1788F4E5AF4FDB804
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+7) {. {-9223372036854775808 -25200 0 -07}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.869188292977557
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOOFwFSXGm2OHmFvGRvn:SlSWB9X5yRSqwTm2OHaOJ
                                                                                                                                                                                                                          MD5:A94A70486CE0942B538D855647EDFE78
                                                                                                                                                                                                                          SHA1:1A20872C6D577DB332F0A536695CE677BC28F294
                                                                                                                                                                                                                          SHA-256:9CF2C86CC6173F19E0DA78CCA46C302469AB5C01752DCEA6A20DC151E2D980CC
                                                                                                                                                                                                                          SHA-512:3B6456D217A08A6DBAC0DB296384F4DED803F080FD5C0FD1527535D85397351C67B3D2BEDF8C4E2FEFD5C0B9297A8DA938CF855CDAA2BB902498B15E75A0F776
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+8) {. {-9223372036854775808 -28800 0 -08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.912907908622555
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDOwcXGm2OHNmuvn:SlSWB9X5yRSwTm2OHNmuv
                                                                                                                                                                                                                          MD5:821C0743B99BBD9B672D1B1606B2DADD
                                                                                                                                                                                                                          SHA1:152C09F6E8079A4036BA8316BE3E739D2ECE674B
                                                                                                                                                                                                                          SHA-256:532D16E2CDBE8E547F54DC22B521153D2215E8B6653336A36F045E0D338B0D1B
                                                                                                                                                                                                                          SHA-512:CCFC5BC6246B4C9EF77081E79F0A0B1DACC79449388AD08F38912E857E77E12824835C447F769A2C9C707C7E6353010A9907CDF3468A94263CF2B21FC1BF4710
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT+9) {. {-9223372036854775808 -32400 0 -09}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):4.849103265985896
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDIyHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRUyJ8RQvn
                                                                                                                                                                                                                          MD5:FA608B6E2F9D0E64D2DF81B277D40E35
                                                                                                                                                                                                                          SHA1:55A7735ACCF6A759D2069388B2943323E23EE56D
                                                                                                                                                                                                                          SHA-256:48A929080C1E7C901246DC83A7A7F87396EAF9D982659460BF33A85B4C3FAE64
                                                                                                                                                                                                                          SHA-512:35A8899B7084E85165886B07B6DD553745558EAF4297F702829A08BF71E5AA18790F0D02229093FA42515C97A1DDA7292F4D019DDB1251370D9896E94738D32A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT-0) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110
                                                                                                                                                                                                                          Entropy (8bit):4.936514686189307
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDI4cXGm2OHMKUbvn:SlSWB9X5yRU4Tm2OHtUbv
                                                                                                                                                                                                                          MD5:CCC4BDA6EDA4933FB64F329E83EB6118
                                                                                                                                                                                                                          SHA1:7C1B47D376966451540B4D095D16973763A73A73
                                                                                                                                                                                                                          SHA-256:A82AA68616ADEB647456EA641587D76981888B3A022C98EA11302D458295A4FA
                                                                                                                                                                                                                          SHA-512:ACC3DF6AA6025B45F06326062B2F0803BB6FD97AAAEBB276731E5DC5C496731C0853D54B2A4476A4A2EC2DD4FFDF69D78255FC8BCAB2412CE86925A94CE0559D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-1) {. {-9223372036854775808 3600 0 +01}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.919647975606158
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDINFedFkXGm2OHMUUJv:SlSWB9X5yRUNCm2OHXQ
                                                                                                                                                                                                                          MD5:566FBA546E6B7668830D1812659AE671
                                                                                                                                                                                                                          SHA1:EF3AF5CE0BB944973D5B2DCC872903F0C3B7F0FF
                                                                                                                                                                                                                          SHA-256:962E810E02BAE087AD969FEB91C07F2CBB868D09E1BA4A453EB4773F7897157A
                                                                                                                                                                                                                          SHA-512:F42BB5ACDE563A8A875D7B3F1C10CE9A5CE7E52FA9EF2D14BDA2C45BCD5A6D9B44227D079853551BAA13EAED32F4CA3C34BAD88E616B528DEF7DFAE7F42929CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-10) {. {-9223372036854775808 36000 0 +10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.958847614227257
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIVEXGm2OHlVVmv:SlSWB9X5yRUVLm2OHlVAv
                                                                                                                                                                                                                          MD5:02F46CC589D114C57B5687A703EB11C6
                                                                                                                                                                                                                          SHA1:5199683CC7E5D18ED686B44E94FB72EA8C978A9A
                                                                                                                                                                                                                          SHA-256:B1BEE376A0CBEA180391835DB97F8EB32873B2B58AD1AA1098E79FAC357799C5
                                                                                                                                                                                                                          SHA-512:A0CDDCD3208D096712868FED0557CDF5FEC5E9FA5FB25864129D2A9047BCD1AFAA8270C1E41368D32DE2A7B1B66157BDCFC17F8CDF3EF6A9F0C74B42814B096F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-11) {. {-9223372036854775808 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.934250404386511
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIjWkXGm2OHwvv0UIvYv:SlSWB9X5yRUjCm2OHwvv0a
                                                                                                                                                                                                                          MD5:F6AF5C34BDE9FFF73F8B9631C0173EE9
                                                                                                                                                                                                                          SHA1:A717214203F4B4952AE12374AE78992084CD5A61
                                                                                                                                                                                                                          SHA-256:622E51EE9D4601DB90818F4B8E324F790F4D2405D66B899FC018A41E00473C0F
                                                                                                                                                                                                                          SHA-512:0B898328A19DA7FE1BD2FB161EF1511684B569E4262C8149A789855C6F86C84360BC9E6BF82BC571BD7C585A30E0658560029FCC7C3C180BC0D2EA1872860753
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-12) {. {-9223372036854775808 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.951215891260531
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIsXGm2OH1dNv74v:SlSWB9X5yRUjm2OHmv
                                                                                                                                                                                                                          MD5:B505D6A064B6D976BD1BDE61AE937F1C
                                                                                                                                                                                                                          SHA1:DBA0EA8DCCB50CC999397129369A340CA8A4C5B5
                                                                                                                                                                                                                          SHA-256:EF28D4D6DAFE3AB08BE1CE9C32FAF7BF8F750332DF0D39314131F88DF463DFAC
                                                                                                                                                                                                                          SHA-512:86A4CA670FBFFF95C9B22DA4E8957A4BE8A805457032AF47BDF08B5047881F692D665BEF8A76045EF50587149EDD52C8994A19CEE9675A3D12939D9CB9DE4649
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-13) {. {-9223372036854775808 46800 0 +13}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):112
                                                                                                                                                                                                                          Entropy (8bit):4.946259136243175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIxmcXGm2OH0FVtQCn:SlSWB9X5yRUxmTm2OH8Jn
                                                                                                                                                                                                                          MD5:6BD2D15FA9AAF7F44D88BED0F6C969F3
                                                                                                                                                                                                                          SHA1:3080291F9C9C9422995583175C560338F626E4CD
                                                                                                                                                                                                                          SHA-256:748D443DA743D385497A43198A114BD8349310494ECC85F47D39745D53F6E291
                                                                                                                                                                                                                          SHA-512:651983293BAD1EDE1211EEAA3CAA28C73F84FFE2B8554CF198DF014BEF6B7413C4C49C3080FC73430804ECCA3D2BDB316B6B735B72E7BA3525B330E6A5352715
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-14) {. {-9223372036854775808 50400 0 +14}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):110
                                                                                                                                                                                                                          Entropy (8bit):4.8751066179878215
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDInHkXGm2OH/VXCYvn:SlSWB9X5yRUnLm2OH/VSC
                                                                                                                                                                                                                          MD5:DAE7D42076F09E2E2A51A58CC253837D
                                                                                                                                                                                                                          SHA1:44C587A71AE31A7424E0F2B005D11F9E0B463E80
                                                                                                                                                                                                                          SHA-256:9D0D3FAD960E9EBF599218213F3AE8A22766B6CB15C8CDBC7ABD8A3FFD75C29A
                                                                                                                                                                                                                          SHA-512:CEE724EEC6EC86FB417CD4D06B3FC17A404953CCE8740A03B024C05C0436340D9B056F3F1B2706284F57CC49FA229EE311D088AFE3D65F0BF946B0A18282ED46
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-2) {. {-9223372036854775808 7200 0 +02}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.903159871492102
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIYdSXGm2OHkNsWYAvn:SlSWB9X5yRUGJm2OHkKWYAv
                                                                                                                                                                                                                          MD5:3CABCADD8398567F6489C263BF55CA89
                                                                                                                                                                                                                          SHA1:0981F225619E92D4B76ECB2C6D186156E46DA63D
                                                                                                                                                                                                                          SHA-256:74EEBD9C48312D68DC5E54B843FACF3DB869E214D37214F1096AF1D6ECF6D9AF
                                                                                                                                                                                                                          SHA-512:1FF86CFDAA407D7EFD0B0DBC32FC8ED03DAADF6D0D83463B4C6DA97B4B8D77FC381C4C140168AA06FA9A5444DDADBB39DBD8F22E4570EE86F2F7608AAFB0C7FC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-3) {. {-9223372036854775808 10800 0 +03}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.92687099262498
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIbSXGm2OHkVsRYvC:SlSWB9X5yRUtm2OHkSQC
                                                                                                                                                                                                                          MD5:C157F79ADE92A69E46472EA921E1370F
                                                                                                                                                                                                                          SHA1:4B9E5AFA769D5BDF3FDF05BC24A6A632C6D86ECB
                                                                                                                                                                                                                          SHA-256:0606FBAB9374A74D4B2ED17DD04D9DCED7131768CCF673C5C3B739727743383F
                                                                                                                                                                                                                          SHA-512:B6814282465ABF4DF31341306050F11ECAAFC5915C420A8E7F8D787E66308C58FF7C348D6CBDB4064C346800564000C7C763BDD01CB8CE3A8A81550F65C9A74C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-4) {. {-9223372036854775808 14400 0 +04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.91086034871979
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDI7wkXGm2OHM0VQL:SlSWB9X5yRU7Em2OHnVQL
                                                                                                                                                                                                                          MD5:AF742680C5A3BA5981DD7F0646EF6CCA
                                                                                                                                                                                                                          SHA1:0753749D4636D561A8942BB1641BDBCC42349A9B
                                                                                                                                                                                                                          SHA-256:5E2D90AF8A161D47F30E1C4A0F5E1CAB5E9F24201557864A02D3009B1ECFEDE0
                                                                                                                                                                                                                          SHA-512:9B738675FC02613929BF90A7C78DD632AB782D20B5E660578AB590858D22BCD79E5AFB191D41E9DF94E2E586B5D2A163AB7D8364A02A5DE60E5B838F8B85D2FD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-5) {. {-9223372036854775808 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.930155028450208
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIgwcXGm2OHETNSTL:SlSWB9X5yRUgwTm2OHETMn
                                                                                                                                                                                                                          MD5:298F4671F470C4628B3174D5D1D0608D
                                                                                                                                                                                                                          SHA1:5626202FB7186B4555C03F94CEE38AD0FAB81F40
                                                                                                                                                                                                                          SHA-256:19760989015244E4F39AC12C07E6665038AE08282DAF8D6DB0BB5E2F642C922D
                                                                                                                                                                                                                          SHA-512:F81B901249D3FAED3805471F256F55463A7A2FC8CB612FF95E698D63F9609D5D1B3B57DD87021C5DD809D971709EC3831351D54E971E25643B67161E9EAD5E25
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-6) {. {-9223372036854775808 21600 0 +06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.883134479361256
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIu/kXGm2OHAXUVSYvC:SlSWB9X5yRUuTm2OHAXUVSYvC
                                                                                                                                                                                                                          MD5:2317D02708980D7F17B1A4BDE971D15F
                                                                                                                                                                                                                          SHA1:2E78CDE3608F6B03DEB534D14D069D3D89DE85EF
                                                                                                                                                                                                                          SHA-256:0BF01EEEBAA49CE9859C2A5835C6A826B158A7BC3B14C473FBB0167ABA9EA4B9
                                                                                                                                                                                                                          SHA-512:21083EAEACD689FD07D458DB82BC2559445A1C558EB8BAF098B71CFD3A599BB756336F847CBE536648AF473E22E0000B2A8C44A45D0866994F03A78D4E841FC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-7) {. {-9223372036854775808 25200 0 +07}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.8680235243759755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIlEXGm2OHN/VsdYK:SlSWB9X5yRUlLm2OHUJ
                                                                                                                                                                                                                          MD5:B940D187558341DBF4D619248C13C7CA
                                                                                                                                                                                                                          SHA1:0C6B11AA9DBC0A395345F79B4B7325FBE870A414
                                                                                                                                                                                                                          SHA-256:DAB4C0E14D2850BF917C5891E864834CA4BFD38D5470F119F529582976551862
                                                                                                                                                                                                                          SHA-512:042176822D8BFD72FFC0727176596430B656E4986636E9869F883B7078389F936EFA8CCFA9BA7ED0963899BD7D134DB9CD25F24C42040781CC37F2701D0CA28A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-8) {. {-9223372036854775808 28800 0 +08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):111
                                                                                                                                                                                                                          Entropy (8bit):4.91213701043219
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRDIedSXGm2OHENScCC:SlSWB9X5yRUwJm2OHsScCC
                                                                                                                                                                                                                          MD5:DD58339761ECF5503A48267CFD8E3837
                                                                                                                                                                                                                          SHA1:B58511A80448D74B38365EA537BBE0D21956F0E2
                                                                                                                                                                                                                          SHA-256:383EFE43E20963058BFCD852813BDA3FCCC0B4A7AC26317E621589B4C97C1B90
                                                                                                                                                                                                                          SHA-512:C865244051882FD141D369435CFEED0A1E1D254C0313C1EFE55F5AF72412BE11F2B76484170B94BC4E9FCC0D2EEC373D523732FF7945999717D5827FCE68F54F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/GMT-9) {. {-9223372036854775808 32400 0 +09}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):153
                                                                                                                                                                                                                          Entropy (8bit):4.836974611939794
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRDVMFHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtyRC1p8RQvn
                                                                                                                                                                                                                          MD5:BE8C5C3B3DACB97FADEB5444976AF56A
                                                                                                                                                                                                                          SHA1:A0464B66E70A1AF7963D2BE7BC1D88E5842EC99A
                                                                                                                                                                                                                          SHA-256:89F4624DC69DE64B7AF9339FE17136A88A0C28F5F300575540F8953B4A621451
                                                                                                                                                                                                                          SHA-512:A0E11D9DF5AD2C14A012E82F24298921780E091EEDD680535658F9CD1337A4103BA0676DF9B58865DD7D2CFA96AEED7BF786B88786FAF31B06713D61B4C0308A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/GMT0) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):158
                                                                                                                                                                                                                          Entropy (8bit):4.862741414606617
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtyRp+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtyRp6BURQvn
                                                                                                                                                                                                                          MD5:2DADDAD47A64889162132E8DA0FFF54F
                                                                                                                                                                                                                          SHA1:EC213743939D699A4EE4846E582B236F8C18CB29
                                                                                                                                                                                                                          SHA-256:937970A93C2EB2D73684B644E671ACA5698BCB228810CC9CF15058D555347F43
                                                                                                                                                                                                                          SHA-512:CA8C45BA5C1AF2F9C33D6E35913CED14B43A7AA37300928F14DEF8CB5E7D56B58968B9EE219A0ACCB4C17C52F0FBD80BD1018EF5426C137628429C7DAA41ACA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Etc/Greenwich) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                                                                          Entropy (8bit):4.857741203314798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yR5FkXGm2OHv1CCn:SlSWB9X5yRHm2OHNLn
                                                                                                                                                                                                                          MD5:415F102602AFB6F9E9F2B58849A32CC9
                                                                                                                                                                                                                          SHA1:002C7D99EBAA57E8599090CFBF39B8BEAABE4635
                                                                                                                                                                                                                          SHA-256:549D4CC4336D35143A55A09C96FB9A36227F812CA070B2468BD3BB6BB4F1E58F
                                                                                                                                                                                                                          SHA-512:6CA28E71F941D714F3AACA619D0F4FEEF5C35514E05953807C225DF976648F257D835B59A03991D009F738C6FD94EB50B4ECA45A011E63AFDCA537FBAC2B6D1B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UCT) {. {-9223372036854775808 0 0 UCT}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):105
                                                                                                                                                                                                                          Entropy (8bit):4.857741203314798
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5yRF3dFkXGm2OHvr:SlSWB9X5yR9dJm2OHj
                                                                                                                                                                                                                          MD5:6343442DDDC19AF39CADD82AC1DDA9BD
                                                                                                                                                                                                                          SHA1:9D20B726C012F14D99E701A69C60F81CB33E9DA6
                                                                                                                                                                                                                          SHA-256:48B88EED5EF95011F41F5CA7DF48B6C71BED711B079E1132B2C1CD538947EF64
                                                                                                                                                                                                                          SHA-512:4CFED8C80D9BC2A75D4659A14F22A507CF55D3DCC88318025BCB8C99AE7909CAF1F11B1ADC363EF007520BF09473CB68357644E41A9BBDAF9DB0B0A44ECC4FBF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Etc/UTC) {. {-9223372036854775808 0 0 UTC}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):158
                                                                                                                                                                                                                          Entropy (8bit):4.825049978035721
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRYzXDJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLyRY7VMr8RI
                                                                                                                                                                                                                          MD5:7BE0766999E671DDD5033A61A8D84683
                                                                                                                                                                                                                          SHA1:D2D3101E78919EB5FE324FFC85503A25CFD725E0
                                                                                                                                                                                                                          SHA-256:90B776CF712B8FE4EEC587410C69A0EC27417E79006132A20288A9E3AC5BE896
                                                                                                                                                                                                                          SHA-512:A4CA58CD4DC09393BBE3C43D0B5E851DEBEEDC0C5CEC7DCED4D24C14796FD336D5607B33296985BD14E7660DCE5C85C0FB625B2F1AD9AC10F1631A76ECEB04B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Universal) $TZData(:Etc/UTC).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):153
                                                                                                                                                                                                                          Entropy (8bit):4.824450775594084
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLyRaQEBURFu:SlSWB9IZaM3yzUFVAIgBLyRYaRI
                                                                                                                                                                                                                          MD5:64ED445C4272D11C85BD2CFC695F180F
                                                                                                                                                                                                                          SHA1:EDE76B52D3EEBCC75C50E17C053009A453D60D42
                                                                                                                                                                                                                          SHA-256:A68D32DA2214B81D1C0C318A5C77975DE7C4E184CB4D60F07858920B11D065FE
                                                                                                                                                                                                                          SHA-512:4CE8FC2B7C389BD2058CE77CD7234D4EA3F81F40204C9190BF0FB6AA693FB40D0638BFB0EB0D9FA20CB88804B73F6EE8202439C1F553B1293C6D2E5964216A1D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Etc/Zulu) $TZData(:Etc/UTC).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8792
                                                                                                                                                                                                                          Entropy (8bit):3.8152682180965747
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nK5UUH6mek6EvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVab:K5VfSTRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:C107BB0AC411789418982B201FF1F857
                                                                                                                                                                                                                          SHA1:71691B3E9FCC3503943BAFD872A881C1F1EE8451
                                                                                                                                                                                                                          SHA-256:2794B605AE149FFB58D88508A663BB54034FD542BF14B56DAE62801971612F5B
                                                                                                                                                                                                                          SHA-512:BFC79B3245526ED54615F613D3158DC4CF44DAF3DB758DBA65977EC91263CEFFA628D36E7CA536E140AF727EC321D9047C36D56303718D1EC5B49F5A8BCAE2E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Amsterdam) {. {-9223372036854775808 1172 0 LMT}. {-4260212372 1172 0 AMT}. {-1693700372 4772 1 NST}. {-1680484772 1172 0 AMT}. {-1663453172 4772 1 NST}. {-1650147572 1172 0 AMT}. {-1633213172 4772 1 NST}. {-1617488372 1172 0 AMT}. {-1601158772 4772 1 NST}. {-1586038772 1172 0 AMT}. {-1569709172 4772 1 NST}. {-1554589172 1172 0 AMT}. {-1538259572 4772 1 NST}. {-1523139572 1172 0 AMT}. {-1507501172 4772 1 NST}. {-1490566772 1172 0 AMT}. {-1470176372 4772 1 NST}. {-1459117172 1172 0 AMT}. {-1443997172 4772 1 NST}. {-1427667572 1172 0 AMT}. {-1406672372 4772 1 NST}. {-1396217972 1172 0 AMT}. {-1376950772 4772 1 NST}. {-1364768372 1172 0 AMT}. {-1345414772 4772 1 NST}. {-1333318772 1172 0 AMT}. {-1313792372 4772 1 NST}. {-1301264372 1172 0 AMT}. {-1282256372 4772 1 NST}. {-1269814772 1172 0 AMT}. {-1250720372 4772 1 NST}. {-123836517
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6690
                                                                                                                                                                                                                          Entropy (8bit):3.730744509734253
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:u7rRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:uXRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:13F10BC59FB9DBA47750CA0B3BFA25E9
                                                                                                                                                                                                                          SHA1:992E50F4111D55FEBE3CF8600F0B714E22DD2B16
                                                                                                                                                                                                                          SHA-256:E4F684F28AD24B60E21707820C40A99E83431A312D26E6093A198CB344C249DC
                                                                                                                                                                                                                          SHA-512:DA5255BDE684BE2C306C6782A61DE38BFCF9CFF5FD117EBDE5EF364A5ED76B5AB88E6F7E08337EEB2CEC9CB03238D9592941BDAA01DFB061F21085D386451AFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Andorra) {. {-9223372036854775808 364 0 LMT}. {-2177453164 0 0 WET}. {-733881600 3600 0 CET}. {481078800 7200 0 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}. {749005200 3600 0 CET}. {764730000 7200 1 CEST}. {780454800 3600 0 CET}. {796179600 7200 1 CEST}. {811904400 3600 0 CET}. {828234000 7200 1 CEST}. {846378000 3600 0 CET}. {859683600 7200 1 CEST}. {877827600 3600 0 CET}. {891133200 7200 1 CEST}. {909277200 3600 0 CET}. {922582800 7200 1 CEST}. {941331600 3600 0 CET}. {9540
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1992
                                                                                                                                                                                                                          Entropy (8bit):3.5867428099003957
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:ce0exLWtjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUH9mt:iDTZVemFLN7NBx333+ix6b0JiGef
                                                                                                                                                                                                                          MD5:103F48F9DDAC5D94F2BECDA949DE5E50
                                                                                                                                                                                                                          SHA1:0582454439DD4E8D69E7E8EE9B8A3F041F062E89
                                                                                                                                                                                                                          SHA-256:823A0A0DBA01D9B34794EB276F9ABB9D2EC1E60660B20EAA2BA097884E3934F2
                                                                                                                                                                                                                          SHA-512:7419A8F5CF49BE76D7CD7D070FF4467CED851EC76E38A07BD590ED64B96DA446968195096DE2F8298C448778E0A40CAE717C8F234CCDBDF5C3C21B7D056EA4C1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Astrakhan) {. {-9223372036854775808 11532 0 LMT}. {-1441249932 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447600 10800 0 +03}. {7961724
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7686
                                                                                                                                                                                                                          Entropy (8bit):3.635151038354021
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:JAK3+9wAuy+Hk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2l:JAKOK1XPzh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:D64695F05822EF0DF9E3762A1BC440A0
                                                                                                                                                                                                                          SHA1:F17F03CFD908753E28F2C67D2C8649B8E24C35F7
                                                                                                                                                                                                                          SHA-256:118289C1754C06024B36AE81FEE96603D182CB3B8D0FE0A7FD16AD34DB81374D
                                                                                                                                                                                                                          SHA-512:3C5BDE2004D6499B46D9BAB8DBFDCC1FC2A729EEA4635D8C6CB4279AEE9B5655CE93D2E3F09B3E7295468007FFB5BE6FEC5429501E8FB4D3C2BCC05177C2158A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Athens) {. {-9223372036854775808 5692 0 LMT}. {-2344642492 5692 0 AMT}. {-1686101632 7200 0 EET}. {-1182996000 10800 1 EEST}. {-1178161200 7200 0 EET}. {-906861600 10800 1 EEST}. {-904878000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844477200 7200 1 CEST}. {-828237600 3600 0 CET}. {-812422800 7200 0 EET}. {-552362400 10800 1 EEST}. {-541652400 7200 0 EET}. {166485600 10800 1 EEST}. {186184800 7200 0 EET}. {198028800 10800 1 EEST}. {213753600 7200 0 EET}. {228873600 10800 1 EEST}. {244080000 7200 0 EET}. {260323200 10800 1 EEST}. {275446800 7200 0 EET}. {291798000 10800 1 EEST}. {307407600 7200 0 EET}. {323388000 10800 1 EEST}. {338936400 7200 0 EET}. {347148000 7200 0 EET}. {354675600 10800 1 EEST}. {370400400 7200 0 EET}. {386125200 10800 1 EEST}. {401850000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {4490
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.827362756219521
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQahs3QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUy70U
                                                                                                                                                                                                                          MD5:19134F27463DEDF7E25BC72E031B856F
                                                                                                                                                                                                                          SHA1:40D9E60D26C592ED79747D1253A9094FCDE5FD33
                                                                                                                                                                                                                          SHA-256:5D31D69F259B5B2DFE016EB1B2B811BD51A1ED93011CBB34D2CF65E4806EB819
                                                                                                                                                                                                                          SHA-512:B80202194A9D547AEC3B845D267736D831FB7E720E171265AC3F0074C8B511518952BF686A235E6DDEFC11752C3BD8A48A184930879B68980AC60E9FAECBFB44
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Belfast) $TZData(:Europe/London).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7059
                                                                                                                                                                                                                          Entropy (8bit):3.733102701717456
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TX6TRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:TWRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:841E21EED6229503BF41A858601453B0
                                                                                                                                                                                                                          SHA1:6F5632B23F2C710106211FBCD2C17DC40B026BFB
                                                                                                                                                                                                                          SHA-256:813B4B4F13401D4F92B0F08FC1540936CCFF91EFD8B8D1A2C5429B23715C2748
                                                                                                                                                                                                                          SHA-512:85863B12F17A4F7FAC14DF4D3AB50CE33C7232A519F7F10CC521AC0F695CD645857BD0807F0A9B45C169DD7C1240E026C567B35D1D157EE3DB3C80A57063E8FE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Belgrade) {. {-9223372036854775808 4920 0 LMT}. {-2713915320 3600 0 CET}. {-905824800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-777942000 7200 1 CEST}. {-766623600 3600 0 CET}. {407199600 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CES
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7746
                                                                                                                                                                                                                          Entropy (8bit):3.733442486698092
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:hgt67dAtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:hiGRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:D1E45A4660E00A361729FCD7413361C1
                                                                                                                                                                                                                          SHA1:BCC709103D07748E909DD999A954DFF7034F065F
                                                                                                                                                                                                                          SHA-256:EAD23E3F58706F79584C1F3F9944A48670F428CACBE9A344A52E19B541AB4F66
                                                                                                                                                                                                                          SHA-512:E3A0E6B4FC80A8D0215C81E95F9D3F71C0D9371EE0F6B2B7E966744C42FC64055370D322918EEA2917BFBA07030629C4493ADA257F9BD9C9BF6AD3C4A7FB1E70
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Berlin) {. {-9223372036854775808 3208 0 LMT}. {-2422054408 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-776559600 10800 0 CEMT}. {-765936000 7200 1 CEST}. {-761180400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733273200 3600 0 CET}. {-717631200 7200 1 CEST}. {-714610800 10800 1 CEMT}. {-710380800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.89628096026481
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVtXrAevFVAIgoquXrELyQahcvEB5yQazXrY:SlSWB9IZaM3ymzbAevFVAIgozbELy7cY
                                                                                                                                                                                                                          MD5:7C0606BC846344D78A85B4C14CE85B95
                                                                                                                                                                                                                          SHA1:CEDFDC3C81E519413DDD634477533C89E8AF2E35
                                                                                                                                                                                                                          SHA-256:D7DF89C23D2803683FE3DB57BF326846C9B50E8685CCCF4230F24A5F4DC8E44E
                                                                                                                                                                                                                          SHA-512:8F07791DE5796B418FFD8945AE13BAB1C9842B8DDC073ED64E12EA8985619B93472C39DD44DA8FAEF5614F4E6B4A9D96E0F52B4ECA11B2CCA9806D2F8DDF2778
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Prague)]} {. LoadTimeZoneFile Europe/Prague.}.set TZData(:Europe/Bratislava) $TZData(:Europe/Prague).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8907
                                                                                                                                                                                                                          Entropy (8bit):3.75854119398076
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:BMlf+jdXtSYv9HMn2vDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHL:BMQSY1RSTRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:FA802B103E8829C07AE7E05DE7F3CD1F
                                                                                                                                                                                                                          SHA1:46AFB26E3E9102F0544C5294DA67DC41E8B2E8FC
                                                                                                                                                                                                                          SHA-256:AEB5860C2F041842229353E3F83CC2FEBC9518B115F869128E94A1605FB4A759
                                                                                                                                                                                                                          SHA-512:488CE6B524071D2B72F8AD73C2DC00F5F4C1C3C93F91165BDA0BCCB2B2C644B792C4220B785E84835ABE81584FDC87A1DCDA7679A69318052C3854167CB43C61
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Brussels) {. {-9223372036854775808 1050 0 LMT}. {-2840141850 1050 0 BMT}. {-2450953050 0 0 WET}. {-1740355200 3600 0 CET}. {-1693702800 7200 0 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1613826000 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585530000 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301263200 0 0 WET}. {-1284328800 3600 1 WEST}. {-126
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7706
                                                                                                                                                                                                                          Entropy (8bit):3.6365022673390808
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:nQrdI+sYixX215VaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:nQrbEm1Oh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:79AAB44507DD6D06FA673CA20D4CF223
                                                                                                                                                                                                                          SHA1:A2F1AA0E3F38EF24CD953C6B5E1EC29EA3EDB8C0
                                                                                                                                                                                                                          SHA-256:C40DC0C9EE5FFF9F329823325A71F3F38BE940F159E64E0B0CED27B280C1F318
                                                                                                                                                                                                                          SHA-512:BBEBB29FFD35A1F8B9D906795032976B3F69A0097ED7D764E3EB45574E66641C35F9006B3295FB090472FF5C09FC4D88D9249E924011A178EFB68D050AA6F871
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Bucharest) {. {-9223372036854775808 6264 0 LMT}. {-2469404664 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {296604000 10800 1 EEST}. {307486800 7200 0 EET}. {323816400 10800 1 EEST}. {338940000 7200 0 EET}. {354672000 10800 0 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7975
                                                                                                                                                                                                                          Entropy (8bit):3.7352769955376464
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ZpduGm56n0PcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:ZpMypRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:25864F8E5372B8E45B71D08667ED093C
                                                                                                                                                                                                                          SHA1:83463D25C839782E2619CD5BE613DA1BD08ACBB5
                                                                                                                                                                                                                          SHA-256:EF5CF8C9B3CA3F772A9C757A2CC1D561E00CB277A58E43ED583A450BBA654BF1
                                                                                                                                                                                                                          SHA-512:0DAB3CA0C82AA80A4F9CC04C191BE180EB41CCF87ADB31F26068D1E6A3A2F121678252E36E387B589552E6F7BA965F7E3F4633F1FD066FC7849B1FD554F39EC7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Budapest) {. {-9223372036854775808 4580 0 LMT}. {-2500938980 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1640998800 3600 0 CET}. {-1633212000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1600466400 7200 1 CEST}. {-1581202800 3600 0 CET}. {-906771600 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-778471200 7200 1 CEST}. {-762660000 3600 0 CET}. {-749689200 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-686185200 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-621990000 7200 1 CEST}. {-605660400 3600 0 CET}. {-492656400 7200 1 CEST}. {-481168800 3600 0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.905738881351689
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQahDZALMFB5h8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5Py7D17/8jH
                                                                                                                                                                                                                          MD5:811B7E0B0EDD151E52DF369B9017E7C0
                                                                                                                                                                                                                          SHA1:3C17D157A626F3AD7859BC0F667E0AB60E821D05
                                                                                                                                                                                                                          SHA-256:221C8BA73684ED7D8CD92978ED0A53A930500A2727621CE1ED96333787174E82
                                                                                                                                                                                                                          SHA-512:7F980E34BBCBC65BBF04526BF68684B3CE780611090392560569B414978709019D55F69368E98ADADC2C47116818A437D5C83F4E6CD40F4A1674D1CF90307CB5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Busingen) $TZData(:Europe/Zurich).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7824
                                                                                                                                                                                                                          Entropy (8bit):3.674889638637008
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:J2rdkayurpKXlGYtXfVA6bN3E48WLCtSYxUFtj2DVXvR2YuXOZp+eiXGEsTVVHU:J2r6G81T9bN3E48GCujWYqK
                                                                                                                                                                                                                          MD5:92966EE642028D4C44C90F86CA1440AA
                                                                                                                                                                                                                          SHA1:95F286585FF3A880F2F909E82F4C22C8F1D12BE3
                                                                                                                                                                                                                          SHA-256:E92FFABF4705F93C2A4AD675555AEBC3C9418AC71EEB487AF0F7CD4EAB0431CE
                                                                                                                                                                                                                          SHA-512:1D6018C83CA5998C590448FE98C59F3FCD0D5D7688B679B7F3C82B6F3209F25323BB302BF847FCCBD950F08A79AF36CA83DBDD4DB8A3557A682152A6B731B663
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Chisinau) {. {-9223372036854775808 6920 0 LMT}. {-2840147720 6900 0 CMT}. {-1637114100 6264 0 BMT}. {-1213148664 7200 0 EET}. {-1187056800 10800 1 EEST}. {-1175479200 7200 0 EET}. {-1159754400 10800 1 EEST}. {-1144029600 7200 0 EET}. {-1127700000 10800 1 EEST}. {-1111975200 7200 0 EET}. {-1096250400 10800 1 EEST}. {-1080525600 7200 0 EET}. {-1064800800 10800 1 EEST}. {-1049076000 7200 0 EET}. {-1033351200 10800 1 EEST}. {-1017626400 7200 0 EET}. {-1001901600 10800 1 EEST}. {-986176800 7200 0 EET}. {-970452000 10800 1 EEST}. {-954727200 7200 0 EET}. {-927165600 10800 1 EEST}. {-898138800 7200 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-800154000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {4179
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7458
                                                                                                                                                                                                                          Entropy (8bit):3.736544358182077
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:1Fpd6z8cRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyo:1FpoRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:8FBF425E5833012C0A6276222721A106
                                                                                                                                                                                                                          SHA1:78C5788ED4184A62E0E2986CC0F39EED3801AD76
                                                                                                                                                                                                                          SHA-256:D2D091740C425C72C46ADDC23799FC431B699B80D244E4BCD7F42E31C1238EEB
                                                                                                                                                                                                                          SHA-512:6DF08142EEBC7AF8A575DD7510B83DBD0E15DDA13801777684355937338CDA3D09E37527912F4EBBCC1B8758E3D65185E6006EB5C1349D1DC3AE7B6131105691
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Copenhagen) {. {-9223372036854775808 3020 0 LMT}. {-2524524620 3020 0 CMT}. {-2398294220 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680490800 3600 0 CET}. {-935110800 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-769388400 3600 0 CET}. {-747010800 7200 1 CEST}. {-736383600 3600 0 CET}. {-715215600 7200 1 CEST}. {-706748400 3600 0 CET}. {-683161200 7200 1 CEST}. {-675298800 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9452
                                                                                                                                                                                                                          Entropy (8bit):3.675115548319436
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:fIfr7ZO/H8XKKRg3psTZ+wfAIt3/LIjzI9jJeK:fIHZO/Hk5RmpsT7/sjzI9jJeK
                                                                                                                                                                                                                          MD5:D9787AD03D1A020F01FFF1F9AB346C09
                                                                                                                                                                                                                          SHA1:C194A0A7F218ABBEB7DB53E3B2062DC349A8C739
                                                                                                                                                                                                                          SHA-256:E1DCBC878C8937FBE378033AEE6B0D8C72827BE3D9C094815BFA47AF92130792
                                                                                                                                                                                                                          SHA-512:4C596C9BDE55605381C9B6F90837BA8C9EA2992EBC7F3ACDC207CFAE7612E8B13415FD4962DC8D3FD2A75D98025D0E052B8B8486F6C31742D791C6A2C1D1827F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Dublin) {. {-9223372036854775808 -1500 0 LMT}. {-2821649700 -1521 0 DMT}. {-1691962479 2079 1 IST}. {-1680471279 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1517011200 0 0 IST}. {-1507500000 3600 1 IST}. {-1490565600 0 0 IST}. {-1473631200 3600 1 IST}. {-1460930400 0 0 IST}. {-1442786400 3600 1 IST}. {-1428876000 0 0 IST}. {-1410732000 3600 1 IST}. {-1396216800 0 0 IST}. {-1379282400 3600 1 IST}. {-1364767200 0 0 IST}. {-1348437600 3600 1 IST}. {-1333317600 0 0 IST}. {-1315778400 3600 1 IST}. {-1301263200 0 0 IST}. {-1284328800 3600 1 IST}. {-1269813600 0 0 IST}. {-1253484000 3600 1 IST}. {-1238364000 0 0 IST}. {-
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9181
                                                                                                                                                                                                                          Entropy (8bit):3.7982744899840535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:i2elBN44y3UKdDDMjEZtcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIV0:i44y1xZGRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:F8AEFE8F561ED7E1DC81117676F7D0E0
                                                                                                                                                                                                                          SHA1:1148176C2766B205B5D459A620D736B1D28283AA
                                                                                                                                                                                                                          SHA-256:FB771A01326E1756C4026365BEE44A6B0FEF3876BF5463EFAB7CF4B97BF87CFC
                                                                                                                                                                                                                          SHA-512:7C06CB215B920911E0DC9D24F0DD6E24DEC3D75FB2D0F175A9B4329304C9761FFFEE329DD797FF4343B41119397D7772D1D3DFC8F90C1DE205380DE463F42854
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Gibraltar) {. {-9223372036854775808 -1284 0 LMT}. {-2821649916 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.830450830776494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQakQAL/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyYL5
                                                                                                                                                                                                                          MD5:DC2B3CAC4AF70A61D0F4C53288CC8D11
                                                                                                                                                                                                                          SHA1:A423E06F88FDEED1960AF3C46A67F1CB9F293CAF
                                                                                                                                                                                                                          SHA-256:9CB6E6FEC9461F94897F0310BFC3682A1134E284A56C729E7F4BCE726C2E2380
                                                                                                                                                                                                                          SHA-512:8B455DA1D1A7AA1259E6E5A5CF90E62BA8073F769DCB8EB82503F2DFB70AA4539A688DC798880339A2722AA1871E8C8F16D8827064A2D7D8F2F232880359C78D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Guernsey) $TZData(:Europe/London).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7120
                                                                                                                                                                                                                          Entropy (8bit):3.635790220811118
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:wQbXHk+PVqVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ9A:w6XPzh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:E7A6AA8962067EF71174CD5AE79A8624
                                                                                                                                                                                                                          SHA1:1250689DF0DFCCDD4B6B21C7867C4AA515D19ECD
                                                                                                                                                                                                                          SHA-256:5FDBE427BC604FAC03316FD08138F140841C8CF2537CDF4B4BB20F2A9DFC4ECB
                                                                                                                                                                                                                          SHA-512:5C590164499C4649D555F30054ECB5CF627CCCA8A9F94842328E90DD40477CADB1042D07EA4C368ABB7094D7A59A8C2EE7619E5B3458A0FAC066979B14AF44A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Helsinki) {. {-9223372036854775808 5989 0 LMT}. {-2890258789 5989 0 HMT}. {-1535938789 7200 0 EET}. {-875671200 10800 1 EEST}. {-859773600 7200 0 EET}. {354672000 10800 1 EEST}. {370396800 7200 0 EET}. {386121600 10800 1 EEST}. {401846400 7200 0 EET}. {410220000 7200 0 EET}. {417574800 10800 1 EEST}. {433299600 7200 0 EET}. {449024400 10800 1 EEST}. {465354000 7200 0 EET}. {481078800 10800 1 EEST}. {496803600 7200 0 EET}. {512528400 10800 1 EEST}. {528253200 7200 0 EET}. {543978000 10800 1 EEST}. {559702800 7200 0 EET}. {575427600 10800 1 EEST}. {591152400 7200 0 EET}. {606877200 10800 1 EEST}. {622602000 7200 0 EET}. {638326800 10800 1 EEST}. {654656400 7200 0 EET}. {670381200 10800 1 EEST}. {686106000 7200 0 EET}. {701830800 10800 1 EEST}. {717555600 7200 0 EET}. {733280400 10800 1 EEST}. {749005200 7200 0 EET}. {764730000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.866592240835745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQaqpfioxp8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUycqO
                                                                                                                                                                                                                          MD5:9E18F66C32ADDDBCEDFE8A8B2135A0AC
                                                                                                                                                                                                                          SHA1:9D2DC5BE334B0C6AEA15A98624321D56F57C3CB1
                                                                                                                                                                                                                          SHA-256:6A03679D9748F4624078376D1FD05428ACD31E7CABBD31F4E38EBCCCF621C268
                                                                                                                                                                                                                          SHA-512:014BAD4EF0209026424BC68CBF3F5D2B22B325D61A4476F1E4F020E1EF9CD4B365213E01C7EC6D9D40FA422FE8FE0FADB1E4CBB7D46905499691A642D813A379
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Isle_of_Man) $TZData(:Europe/London).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3974
                                                                                                                                                                                                                          Entropy (8bit):3.7140382290341214
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:kICNapz9QnPPWDeP/vamdc2MKJ9k2gsh6YlnG:kuQnPo+CWJipP
                                                                                                                                                                                                                          MD5:5F2F14127F11060A57C53565A24CB8F8
                                                                                                                                                                                                                          SHA1:E79FC982C018CC7E3C29A956048ED3D0CFFE3311
                                                                                                                                                                                                                          SHA-256:EAD62B6D04AA7623B9DF94D41E04C9E30C7BA8EB2CE3504105A0496A66EB87AE
                                                                                                                                                                                                                          SHA-512:E709849DEF7F7CDAE3CA44F1939DF49D6FE5DE9C89F541343256FC0F7B9E55390AC496FF599D94B7F594D6BAE724AE4608A43F5870C18210525B061E801CC36B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Istanbul) {. {-9223372036854775808 6952 0 LMT}. {-2840147752 7016 0 IMT}. {-1869875816 7200 0 EET}. {-1693706400 10800 1 EEST}. {-1680490800 7200 0 EET}. {-1570413600 10800 1 EEST}. {-1552186800 7200 0 EET}. {-1538359200 10800 1 EEST}. {-1522551600 7200 0 EET}. {-1507514400 10800 1 EEST}. {-1490583600 7200 0 EET}. {-1440208800 10800 1 EEST}. {-1428030000 7200 0 EET}. {-1409709600 10800 1 EEST}. {-1396494000 7200 0 EET}. {-931140000 10800 1 EEST}. {-922762800 7200 0 EET}. {-917834400 10800 1 EEST}. {-892436400 7200 0 EET}. {-875844000 10800 1 EEST}. {-857358000 7200 0 EET}. {-781063200 10800 1 EEST}. {-764737200 7200 0 EET}. {-744343200 10800 1 EEST}. {-733806000 7200 0 EET}. {-716436000 10800 1 EEST}. {-701924400 7200 0 EET}. {-684986400 10800 1 EEST}. {-670474800 7200 0 EET}. {-654141600 10800 1 EEST}. {-639025200 7200 0 EET}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.831245786685746
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6yQap6cEBx/yQavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUyzO5
                                                                                                                                                                                                                          MD5:F43ABA235B8B98F5C64181ABD1CEEC3A
                                                                                                                                                                                                                          SHA1:A4A7D71ED148FBE53C2DF7497A89715EB24E84B7
                                                                                                                                                                                                                          SHA-256:8E97798BE473F535816D6D9307B85102C03CC860D3690FE59E0B7EEF94D62D54
                                                                                                                                                                                                                          SHA-512:B0E0FC97F08CB656E228353594FC907FC94A998859BB22648BF78043063932D0FC7282D31F63FCB79216218695B5DCDF298C37F0CB206160798CF3CA2C7598E1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:Europe/Jersey) $TZData(:Europe/London).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2397
                                                                                                                                                                                                                          Entropy (8bit):3.8622541648513464
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:cGv6a621nwJ2JoJrv0WvXlnDqVV0Qv3LEevBFoBGrjI9q1F008bBJd8:cGvt67yurvxXl6V/DYtX6
                                                                                                                                                                                                                          MD5:FE44AD99AF96A031D21D308B0E534928
                                                                                                                                                                                                                          SHA1:36A666585D0895155D31A6E5AFD6B7395C7334AA
                                                                                                                                                                                                                          SHA-256:0C65366AB59C4B8734DE0F69E7081269A367116363EB3863D16FB7184CCC5EB9
                                                                                                                                                                                                                          SHA-512:2789E8FC8FD73A0D3C915F5CBAD158D2A4995EE51607C4368F3AE1CC6418E93E204E4FCE6F796CDC60BB2E0ED8F79650DA4549C7663589B58E189D0D10F059C5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kaliningrad) {. {-9223372036854775808 4920 0 LMT}. {-2422056120 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 7200 0 CET}. {-778730400 10800 1 CEST}. {-762663600 7200 0 CET}. {-757389600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7202
                                                                                                                                                                                                                          Entropy (8bit):3.6738341956502953
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:j/fE2JyurpyVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:j/fN8GHh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:4E693AC10DD3FC66700A878B94D3701D
                                                                                                                                                                                                                          SHA1:692200B78A3EA482577D13BE5588FEB0BF94DF01
                                                                                                                                                                                                                          SHA-256:3AAC94E73BB4C803BBB4DE14826DAA0AC82BAE5C0841FD7C58B62A5C155C064D
                                                                                                                                                                                                                          SHA-512:9B68D418B98DDF855C257890376AEC300FC6024E08C85AF5CFFE70BE9AC39D75293C35D841DB8A7BE5574FD185D736F5CB72205531736A202D25305744A2DD15
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kiev) {. {-9223372036854775808 7324 0 LMT}. {-2840148124 7324 0 KMT}. {-1441159324 7200 0 EET}. {-1247536800 10800 0 MSK}. {-892522800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-825382800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {646786800 10800 1 EEST}. {686102400 7200 0 EET}. {701820000 10800 1 EEST}. {717541200 7200 0 EET}. {733269600 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1959
                                                                                                                                                                                                                          Entropy (8bit):3.5751912319178496
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:c1e/5gjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUH9mUBR:dWDTZVemFLN7NBx333+ix6b0JiG1
                                                                                                                                                                                                                          MD5:249037A8019D3A5244DD59D8C3316403
                                                                                                                                                                                                                          SHA1:2DABDE83753CE65D1A2D3949FF9B94401A2DD8C3
                                                                                                                                                                                                                          SHA-256:5FE8535DD9A4729B68BF5EC178C6F978753A4A01BDC6F5529C2F8A3872B470D1
                                                                                                                                                                                                                          SHA-512:4180DE17FDDA1417DD24229F775DD45FDE99078E71F2A583E6629D022DCD1B30CEB1ABCEEC78286CAE286E8CBAFC5A7AB20464D53B8BE2615B4681302C05B120
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Kirov) {. {-9223372036854775808 11928 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447600 10800 0 +03}. {796172400 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9471
                                                                                                                                                                                                                          Entropy (8bit):3.738653060534981
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1SgVSz+IZHX68PlXIFj544IrvfMsbxZTH7qwQ:1SYSz+IZHX68PlYFUM8xZTH7qwQ
                                                                                                                                                                                                                          MD5:AD82B05F966F0EAD5B2F4FD7B6D56718
                                                                                                                                                                                                                          SHA1:DE5A9BB8B0FCA79C38DD35905FF074503D5AAF13
                                                                                                                                                                                                                          SHA-256:EE61A08BED392B75FBE67666BDCF7CE26DFA570FC2D1DEC9FFEF51E5D8CD8DF7
                                                                                                                                                                                                                          SHA-512:68DC078090E2AF1EAF0150BBCF63E52E4675BF22E2FF6BBA4B4D0B244BFF23C73310A3E63365A4217B8466F2C2E7A4384D05D778F70513183B3A59016A55DDB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Lisbon) {. {-9223372036854775808 -2205 0 LMT}. {-2713908195 -2205 0 LMT}. {-1830384000 0 0 WET}. {-1689555600 3600 1 WEST}. {-1677801600 0 0 WET}. {-1667437200 3600 1 WEST}. {-1647738000 0 0 WET}. {-1635814800 3600 1 WEST}. {-1616202000 0 0 WET}. {-1604365200 3600 1 WEST}. {-1584666000 0 0 WET}. {-1572742800 3600 1 WEST}. {-1553043600 0 0 WET}. {-1541206800 3600 1 WEST}. {-1521507600 0 0 WET}. {-1442451600 3600 1 WEST}. {-1426813200 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1221440400 3600 1 WEST}. {-1206925200 0 0 WET}. {-1191200400 3600 1 WEST}. {-1175475600 0 0 WET}. {-1127696400 3600 1 WEST}. {-1111971600 0 0 WET}. {-1096851600 3600 1 WEST}. {-1080522000
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.901869793666386
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQavPSJ5QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqm
                                                                                                                                                                                                                          MD5:5F2AEC41DECD9E26955876080C56B247
                                                                                                                                                                                                                          SHA1:4FDEC0926933AE5651DE095C519A2C4F9E567691
                                                                                                                                                                                                                          SHA-256:88146DA16536CCF587907511FB0EDF40E392E6F6A6EFAB38260D3345CF2832E1
                                                                                                                                                                                                                          SHA-512:B71B6C21071DED75B9B36D49EB5A779C5F74817FF070F70FEAB9E3E719E5F1937867547852052AA7BBAE8B842493FBC7DFAFD3AC47B70D36893541419DDB2D74
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Ljubljana) $TZData(:Europe/Belgrade).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9839
                                                                                                                                                                                                                          Entropy (8bit):3.737361476589814
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Gj4y1xZfvm8nKrhFs3XRnRaQqTLJaMt/VZ1R6Y+:GjPxZfvmgEhS3XRmau/VZ1R6Y+
                                                                                                                                                                                                                          MD5:2A53A87C26A5D2AF62ECAAD8CECBF0D7
                                                                                                                                                                                                                          SHA1:025D31C1D32F1100C1B00858929FD29B4E66E8F6
                                                                                                                                                                                                                          SHA-256:2A69A7C9A2EE3057EBDB2615DBE5CB08F5D334210449DC3E42EA88564C29583A
                                                                                                                                                                                                                          SHA-512:81EFA13E4AB30A9363E80EC1F464CC51F8DF3C492771494F3624844E074BA9B84FE50EF6C32F9467E6DAB41BD5159B492B752D0C97F3CB2F4B698C04E68C0255
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/London) {. {-9223372036854775808 -75 0 LMT}. {-3852662325 0 0 GMT}. {-1691964000 3600 1 BST}. {-1680472800 0 0 GMT}. {-1664143200 3600 1 BST}. {-1650146400 0 0 GMT}. {-1633903200 3600 1 BST}. {-1617487200 0 0 GMT}. {-1601848800 3600 1 BST}. {-1586037600 0 0 GMT}. {-1570399200 3600 1 BST}. {-1552168800 0 0 GMT}. {-1538344800 3600 1 BST}. {-1522533600 0 0 GMT}. {-1507500000 3600 1 BST}. {-1490565600 0 0 GMT}. {-1473631200 3600 1 BST}. {-1460930400 0 0 GMT}. {-1442786400 3600 1 BST}. {-1428876000 0 0 GMT}. {-1410732000 3600 1 BST}. {-1396216800 0 0 GMT}. {-1379282400 3600 1 BST}. {-1364767200 0 0 GMT}. {-1348437600 3600 1 BST}. {-1333317600 0 0 GMT}. {-1315778400 3600 1 BST}. {-1301263200 0 0 GMT}. {-1284328800 3600 1 BST}. {-1269813600 0 0 GMT}. {-1253484000 3600 1 BST}. {-1238364000 0 0 GMT}. {-1221429600 3600 1 BST}. {-120
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8826
                                                                                                                                                                                                                          Entropy (8bit):3.7634145613638657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TYt4c9+dcVhv9HMLftvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAr:0w2h1QSTRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:804A17ED0B32B9751C38110D28EB418B
                                                                                                                                                                                                                          SHA1:24235897E163D33970451C48C4260F6C10C56ADD
                                                                                                                                                                                                                          SHA-256:00E8152B3E5CD216E4FD8A992250C46E600E2AD773EEDDD87DAD31012BE55693
                                                                                                                                                                                                                          SHA-512:53AFDDE8D516CED5C6CF0A906DBF72AF09A62278D1FC4D5C1562BBCE853D322457A6346C3DE8F112FCF665102E19A2E677972E941D0C80D0AB7C8DD0B694628E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Luxembourg) {. {-9223372036854775808 1476 0 LMT}. {-2069713476 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1662343200 7200 1 CEST}. {-1650157200 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1612659600 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585519200 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552258800 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520550000 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490572800 0 0 WET}. {-1473642000 3600 1 WEST}. {-1459119600 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427673600 0 0 WET}. {-1411866000 3600 1 WEST}. {-1396224000 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301270400 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269813600 0 0 WET}. {-1253484000 3600 1 WEST}. {-
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8225
                                                                                                                                                                                                                          Entropy (8bit):3.745589534746728
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:kHF0p8d9VPb/aKrwSSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVab:oNHzy8STRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:795CAAE9AECE3900DEA1F5EBD0ED668B
                                                                                                                                                                                                                          SHA1:61F1745E7B60E19F1286864B7A4285E8CCF11202
                                                                                                                                                                                                                          SHA-256:4BE326DD950DDAD6FB9C392A31CEED1CB1525D043F1F7C14332FEB226AEA1859
                                                                                                                                                                                                                          SHA-512:BBBABBE86A757D3EE9267128E7DA810346E74FD9CD3EF37192A831958FF0EDBBE47F14DA63669F6799056081D0365194E22D64D14B97490E4333504DFE22D151
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Madrid) {. {-9223372036854775808 -884 0 LMT}. {-2177452800 0 0 WET}. {-1631926800 3600 1 WEST}. {-1616889600 0 0 WET}. {-1601168400 3600 1 WEST}. {-1585353600 0 0 WET}. {-1442451600 3600 1 WEST}. {-1427673600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364774400 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333324800 0 0 WET}. {-1316390400 3600 1 WEST}. {-1301270400 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269820800 0 0 WET}. {-1026954000 3600 1 WEST}. {-1017619200 0 0 WET}. {-1001898000 3600 1 WEST}. {-999482400 7200 1 WEMT}. {-986090400 3600 1 WEST}. {-954115200 0 0 WET}. {-940208400 3600 0 CET}. {-873079200 7200 1 CEST}. {-862621200 3600 0 CET}. {-842839200 7200 1 CEST}. {-828320400 3600 0 CET}. {-811389600 7200 1 CEST}. {-796870800 3600 0 CET}. {-779940000 7200 1 CEST}. {-765421200 3600 0 CET}. {-748490400 7200 1 CEST}. {-733971600
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8425
                                                                                                                                                                                                                          Entropy (8bit):3.728789296531475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:wqZKgpNc6sln3mcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZY:wChslJRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:5F73FCB70E5B27E540C1A5133F3B791C
                                                                                                                                                                                                                          SHA1:406A2FB6439A3532150D69E711F253665F000B3C
                                                                                                                                                                                                                          SHA-256:5E3BB07FD3592163A756596A25060683CDA7930C7F4411A406B3E1506F9B901C
                                                                                                                                                                                                                          SHA-512:5263ABBE91D95BDD359B666BCDDAA6B4C8B810E986B9A94A80AF2B28E48C9C949EC5D5F21158AD306F7AF5BB6A47408C9AA5C5BB6D0053A9B9DA89E76E126FB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Malta) {. {-9223372036854775808 3484 0 LMT}. {-2403478684 3600 0 CET}. {-1690765200 7200 1 CEST}. {-1680487200 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1648951200 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616896800 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585533600 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555293600 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812588400 7200 1 CEST}. {-798073200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 CEST}. {-71715600 3600 0 CET}. {-50547600 7200 1 CEST}. {-40266000 3600 0 CET}
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.913470013356756
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV1AYKjGyVAIgoq2AYKjvCW6yQausWILMFJ8QarAYKa:SlSWB9IZaM3ymrAdjGyVAIgorAdjoyGK
                                                                                                                                                                                                                          MD5:CFB0DE2E11B8AF400537BD0EF493C004
                                                                                                                                                                                                                          SHA1:32E8FCB8571575E9DFE09A966F88C7D3EBCD183E
                                                                                                                                                                                                                          SHA-256:5F82A28F1FEE42693FD8F3795F8E0D7E8C15BADF1FD9EE4D45794C4C0F36108C
                                                                                                                                                                                                                          SHA-512:9E36B2EACA06F84D56D9A9A0A83C7C106D26A6A55CBAA696729F105600F5A0105F193899D5996C416EFAABC4649E91BA0ED90D38E8DF7B305C6D951A31C80718
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Helsinki)]} {. LoadTimeZoneFile Europe/Helsinki.}.set TZData(:Europe/Mariehamn) $TZData(:Europe/Helsinki).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2102
                                                                                                                                                                                                                          Entropy (8bit):3.8519171770148932
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:K6ccjMsJ2JoJrZXnDqVV0Qv3LEevBFoBGrjI9q1F008bBJdO:PRjMAyurZX6V/DYtXE
                                                                                                                                                                                                                          MD5:E5ECB372FF8F5ED274597551ED2C35F0
                                                                                                                                                                                                                          SHA1:6792E2676C59F43B9F260AF2F33E4C2484E71D64
                                                                                                                                                                                                                          SHA-256:78A57D601978869FCAA2737BEC4FDAB72025BC5FDDF7188CCC89034FA767DA6C
                                                                                                                                                                                                                          SHA-512:261FFB4C7974C5F1C0AECA49D9B26F3BC2998C63CEF9CB168B1060E9EC12F7057DB5376128AFD8A31AF2CC9EF79577E96CD9863AA46AC330A5F057F72E43B7B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Minsk) {. {-9223372036854775808 6616 0 LMT}. {-2840147416 6600 0 MMT}. {-1441158600 7200 0 EET}. {-1247536800 10800 0 MSK}. {-899780400 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-804646800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {670374000 7200 0 EEMMTT}. {670377600 10800 1 EEST}. {686102400 7200 0 EET}. {7018272
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8871
                                                                                                                                                                                                                          Entropy (8bit):3.7700564621466666
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:2LCV8tXttpD72RXbvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHT/:eAYt+STRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:B2BA91B2CDD19E255B68EA35E033C061
                                                                                                                                                                                                                          SHA1:246E377E815FFC11BBAF898E952194FBEDAE9AA2
                                                                                                                                                                                                                          SHA-256:768E3D45DB560777C8E13ED9237956CFE8630D840683FAD065A2F6948FD797BE
                                                                                                                                                                                                                          SHA-512:607383524C478F1CB442679F6DE0964F8916EE1A8B0EF6806BDF7652E4520B0E842A611B432FB190C30C391180EA1867268BBBF6067310F70D5E72CB3E4D789F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Monaco) {. {-9223372036854775808 1772 0 LMT}. {-2486680172 561 0 PMT}. {-1855958961 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2347
                                                                                                                                                                                                                          Entropy (8bit):3.859849674605335
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cYedmnClAHEFFkebUe9OtUe9h7+UeGH3UeRUeIuUeKqCbUeaJJUevTkUetUeibEV:kmnAA4F7wxJ2JoJrprXn1CL9yLI0vjls
                                                                                                                                                                                                                          MD5:AB2CB4A38196852883272148B4A14085
                                                                                                                                                                                                                          SHA1:ED22233A615B775DB528053807858A0B69E9D4FB
                                                                                                                                                                                                                          SHA-256:D9814005CB99F2275A4356A8B226E16C7C823ADC940F3A7BBB909D4C01BF44E3
                                                                                                                                                                                                                          SHA-512:F2179FC1C15954FD7F7B824C5310183C96EDC630880E1C8C85DF4423ECC5994B8A9CA826745CC8BCA77945A36BCADAA87620C31FFBD40071438695A610EBF045
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Moscow) {. {-9223372036854775808 9017 0 LMT}. {-2840149817 9017 0 MMT}. {-1688265017 9079 0 MMT}. {-1656819079 12679 1 MST}. {-1641353479 9079 0 MMT}. {-1627965079 16279 1 MDST}. {-1618716679 12679 1 MST}. {-1596429079 16279 1 MDST}. {-1593820800 14400 0 MSD}. {-1589860800 10800 0 MSK}. {-1542427200 14400 1 MSD}. {-1539493200 18000 1 +05}. {-1525323600 14400 1 MSD}. {-1491188400 7200 0 EET}. {-1247536800 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.73570159193188
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq85GKLWVAIgNwMGKLG6yQatHefeWFKYGKL1:SlSWB9IZaM3yZdLWVAIgGMdL9y3HefeW
                                                                                                                                                                                                                          MD5:47C275C076A278CA8E1FF24E9E46CC22
                                                                                                                                                                                                                          SHA1:55992974C353552467C2B57E3955E4DD86BBFAD2
                                                                                                                                                                                                                          SHA-256:34B61E78EF15EA98C056C1AC8C6F1FA0AE87BD6BC85C58BE8DA44D017B2CA387
                                                                                                                                                                                                                          SHA-512:1F74FC0B452C0BE35360D1C9EC8347063E8480CA37BE893FD4FF7FC2279B7D0C0909A26763C7755DFB19BE9736340D3FB00D39E9F6BF23C1D2F0015372139847
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Nicosia)]} {. LoadTimeZoneFile Asia/Nicosia.}.set TZData(:Europe/Nicosia) $TZData(:Asia/Nicosia).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7651
                                                                                                                                                                                                                          Entropy (8bit):3.7309855254369766
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:aG6sT+cQJWxdocRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:abcQJWxd/RNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:2A3F771DD9EAE2E9C1D8394C12C0ED71
                                                                                                                                                                                                                          SHA1:541DCF144EFFE2DFF27B81A50D245C7385CC0871
                                                                                                                                                                                                                          SHA-256:8DDFB0296622E0BFDBEF4D0C2B4EA2522DE26A16D05340DFECA320C0E7B2B1F7
                                                                                                                                                                                                                          SHA-512:E1526BD21E379F8B2285481E3E12C1CF775AE43E205D3E7E4A1906B87821D5E15B101B24463A055B6013879CD2777112C7F27B5C5220F280E3C48240367AA663
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Oslo) {. {-9223372036854775808 2580 0 LMT}. {-2366757780 3600 0 CET}. {-1691884800 7200 1 CEST}. {-1680573600 3600 0 CET}. {-927511200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 0 CEST}. {-765327600 3600 0 CET}. {-340844400 7200 1 CEST}. {-324514800 3600 0 CET}. {-308790000 7200 1 CEST}. {-293065200 3600 0 CET}. {-277340400 7200 1 CEST}. {-261615600 3600 0 CET}. {-245890800 7200 1 CEST}. {-230166000 3600 0 CET}. {-214441200 7200 1 CEST}. {-198716400 3600 0 CET}. {-182991600 7200 1 CEST}. {-166662000 3600 0 CET}. {-147913200 7200 1 CEST}. {-135212400 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {40185
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8838
                                                                                                                                                                                                                          Entropy (8bit):3.7637328221887567
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:1XV8tXttpD724lvDGwdSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIu:1FYtPSTRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:153CA0EF3813D91C5E23B34ADFE7A318
                                                                                                                                                                                                                          SHA1:F7F18CB34424A9B62172F00374853F1D4A89BEE4
                                                                                                                                                                                                                          SHA-256:092BF010A1CF3819B102C2A70340F4D67C87BE2E6A8154716241012B5DFABD88
                                                                                                                                                                                                                          SHA-512:E2D418D43D9DFD169238DDB0E790714D3B88D16398FA041A9646CB35F24EF79EE48DA4B6201E6A598E89D4C651F8A2FB9FB874B2010A51B3CD35A86767BAF4D2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Paris) {. {-9223372036854775808 561 0 LMT}. {-2486678901 561 0 PMT}. {-1855958901 0 0 WET}. {-1689814800 3600 1 WEST}. {-1680397200 0 0 WET}. {-1665363600 3600 1 WEST}. {-1648342800 0 0 WET}. {-1635123600 3600 1 WEST}. {-1616893200 0 0 WET}. {-1604278800 3600 1 WEST}. {-1585443600 0 0 WET}. {-1574038800 3600 1 WEST}. {-1552266000 0 0 WET}. {-1539997200 3600 1 WEST}. {-1520557200 0 0 WET}. {-1507510800 3600 1 WEST}. {-1490576400 0 0 WET}. {-1470618000 3600 1 WEST}. {-1459126800 0 0 WET}. {-1444006800 3600 1 WEST}. {-1427677200 0 0 WET}. {-1411952400 3600 1 WEST}. {-1396227600 0 0 WET}. {-1379293200 3600 1 WEST}. {-1364778000 0 0 WET}. {-1348448400 3600 1 WEST}. {-1333328400 0 0 WET}. {-1316394000 3600 1 WEST}. {-1301274000 0 0 WET}. {-1284339600 3600 1 WEST}. {-1269824400 0 0 WET}. {-1253494800 3600 1 WEST}. {-1238374800 0 0 W
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.86256001696314
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQazKIGl1/yQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq7
                                                                                                                                                                                                                          MD5:4F430ECF91032E40457F2D2734887860
                                                                                                                                                                                                                          SHA1:D1C099523C34ED0BD48C24A511377B232548591D
                                                                                                                                                                                                                          SHA-256:F5AB2E253CA0AB7A9C905B720B19F713469877DE1874D5AF81A8F3E74BA17FC8
                                                                                                                                                                                                                          SHA-512:2E6E73076A18F1C6C8E89949899F81F232AE66FEB8FFA2A5CE5447FFF581A0D5E0E88DABEAA3C858CC5544C2AE9C6717E590E846CBFD58CEF3B7558F677334FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Podgorica) $TZData(:Europe/Belgrade).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7763
                                                                                                                                                                                                                          Entropy (8bit):3.7367850410615597
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:3Nt6F3oxSscRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUE:3/xSTRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:D04290286789AB05490A7DE8569D80AB
                                                                                                                                                                                                                          SHA1:B65938E29CBFB65D253E041EE1CD92FE75C3C663
                                                                                                                                                                                                                          SHA-256:60494447C38C67E8173D4A9CDBA8D16AF90545FA83F3558DB8C9B7D0D052DD45
                                                                                                                                                                                                                          SHA-512:B0897CD4785D737B7C5E5CE717B55AEE8689F83105DDB8A0DA2B4977961124AFA5AF573D57AA4467E5DB68FC5F927D7B58AEE7280238392C5666CC090476EC91
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Prague) {. {-9223372036854775808 3464 0 LMT}. {-3786829064 3464 0 PMT}. {-2469401864 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-777862800 7200 0 CEST}. {-765327600 3600 0 CET}. {-746578800 7200 1 CEST}. {-733359600 3600 0 CET}. {-728517600 0 1 GMT}. {-721260000 0 0 CET}. {-716425200 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654217200 7200 1 CEST}. {-639010800 3600 0 CET}. {283993200 3600 0 CET}. {291776400 7200 1 CEST}. {307501200 3600 0 CET}. {323830800 7200 1 CEST}. {338
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7400
                                                                                                                                                                                                                          Entropy (8bit):3.686652767751974
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:A46YyurGXl6V/jfaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:AnGG160h2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:5F71EBD41FC26CA6FAA0A26CE83FA618
                                                                                                                                                                                                                          SHA1:0FC66EEB374A2930A7F6E2BB5B7D6C4FD00A258C
                                                                                                                                                                                                                          SHA-256:6F63E58F355EF6C4CF8F954E01544B0E152605A72B400C731E3100B422A567D0
                                                                                                                                                                                                                          SHA-512:20B730949A4967C49D259D4D00D8020579580F7FAA0278FBCEBDF8A8173BBF63846DDBF26FFFBBADB0FAF3FD0EB427DBB8CF18A4A80F7B023D2027CC952A773F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Riga) {. {-9223372036854775808 5794 0 LMT}. {-2840146594 5794 0 RMT}. {-1632008194 9394 1 LST}. {-1618702594 5794 0 RMT}. {-1601681794 9394 1 LST}. {-1597275394 5794 0 RMT}. {-1377308194 7200 0 EET}. {-928029600 10800 0 MSK}. {-899521200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-795834000 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8511
                                                                                                                                                                                                                          Entropy (8bit):3.729257183076779
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:YnZKupNc6XTWycRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQt:YVhiRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:3E209874EA8830B8436F897B0B7682B1
                                                                                                                                                                                                                          SHA1:FC9AB2212C10C25850ACE69DC3BE125FD0912092
                                                                                                                                                                                                                          SHA-256:626E7F8389382108E323B8447416BAC420A29442D852817024A39A97D556F365
                                                                                                                                                                                                                          SHA-512:24C1A7890E076C4D58426D62726BC21FA6F70F16B5E9797405B7404AACB1CB2FC283483018418EF0CEE43720838864E01427C60269D98866A48F35CAF0483EFA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Rome) {. {-9223372036854775808 2996 0 LMT}. {-3259097396 2996 0 RMT}. {-2403565200 3600 0 CET}. {-1690765200 7200 1 CEST}. {-1680487200 3600 0 CET}. {-1664758800 7200 1 CEST}. {-1648951200 3600 0 CET}. {-1635123600 7200 1 CEST}. {-1616896800 3600 0 CET}. {-1604278800 7200 1 CEST}. {-1585533600 3600 0 CET}. {-1571014800 7200 1 CEST}. {-1555293600 3600 0 CET}. {-932432400 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-830307600 7200 0 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-807152400 7200 0 CEST}. {-798073200 3600 0 CET}. {-781052400 7200 1 CEST}. {-766717200 3600 0 CET}. {-750898800 7200 1 CEST}. {-733359600 3600 0 CET}. {-719456400 7200 1 CEST}. {-701917200 3600 0 CET}. {-689209200 7200 1 CEST}. {-670460400 3600 0 CET}. {-114051600 7200 1 CEST}. {-103168800 3600 0 CET}. {-81997200 7200 1 C
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2045
                                                                                                                                                                                                                          Entropy (8bit):3.5710319343050183
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cBesqgOjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUHiWnb:rdDTZVemFLN7NBx3BngyxJvqJ2FJ/jz
                                                                                                                                                                                                                          MD5:30271DF851CE290256FA0BE793F3A918
                                                                                                                                                                                                                          SHA1:307BF37BD5110537B023A648AAC41F86E3D34ACB
                                                                                                                                                                                                                          SHA-256:11400A62327FB9DEFB2D16EBD8E759F94C37EF4F12C49AC97DA2E5031FFA0079
                                                                                                                                                                                                                          SHA-512:3E86BDF258BA23AFF9E1BDCDFE7853D5413A589160F67AF7424CE014B7A77A948B8BF973EB02A0FFFE47D5D0EA4464D851DF294C04AF685C0AF7A0EB08DD9067
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Samara) {. {-9223372036854775808 12020 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +04}. {-1102305600 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 7200 0 +03}. {670377600 10800 1 +03}. {686102400 10800 0 +03}. {687916800 14400 0 +04}. {701820000 18000 1 +05}. {717544800 14400 0 +04}. {733269600 18000 1 +05}. {748994400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.908962717024613
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQawELDX7x/yQax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyt/yR
                                                                                                                                                                                                                          MD5:C50388AD7194924572FA470761DD09C7
                                                                                                                                                                                                                          SHA1:EF0A2223B06BE12EFE55EE72BF2C941B7BFB2FFE
                                                                                                                                                                                                                          SHA-256:7F89757BAE3C7AE59200DCEEEE5C38A7F74EBAA4AA949F54AFD5E9BB64B13123
                                                                                                                                                                                                                          SHA-512:0CE5FF2F839CD64A2C9A5AE6BBE122C91342AE44BDECDB9A3BA9F08578BC0B474BC0AF0E773868B273423289254909A38902B225A0092D048AC44BCF883AB4B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/San_Marino) $TZData(:Europe/Rome).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.890934294125181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawEX3GEaQahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqa
                                                                                                                                                                                                                          MD5:5C12CEEDB17515260E2E143FB8F867F5
                                                                                                                                                                                                                          SHA1:51B9CDF922BFBA52BF2618B63435EC510DEAE423
                                                                                                                                                                                                                          SHA-256:7C45DFD5F016982F01589FD2D1BAF97898D5716951A4E08C3540A76E8D56CEB1
                                                                                                                                                                                                                          SHA-512:7A6B7FDFD6E5CFEB2D1AC136922304B0A65362E19307E0F1E20DBF48BED95A262FAC9CBCDB015C3C744D57118A85BD47A57636A05144430BF6707404F8E53E8C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Sarajevo) $TZData(:Europe/Belgrade).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1990
                                                                                                                                                                                                                          Entropy (8bit):3.5705804674707893
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cWe35gjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkwLUk+EUhtCUH9mUBU9R:qWDTZVemFLN70333+ix6b0JiGk
                                                                                                                                                                                                                          MD5:EEA55E1788265CCC7B3BDB775AF3DD38
                                                                                                                                                                                                                          SHA1:E327A5965114AB8BF6E479989E43786F0B74CFB1
                                                                                                                                                                                                                          SHA-256:0031D4DEC64866DEB1B5E566BB957F2C0E46E5751B31DF9C8A3DA1912AEC4CB2
                                                                                                                                                                                                                          SHA-512:21EF7D364814259F23319D4BC0E4F7F0653D35C1DD03D22ACD8E9A540EE8A9E651BEE22501E4150F6C74901AC2ED750CE08AAE0551DF5A44AB11FD4A3DB49D59
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Saratov) {. {-9223372036854775808 11058 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 10800 0 +04}. {575420400 14400 1 +04}. {591145200 10800 0 +03}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447600 10800 0 +03}. {796172400
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2307
                                                                                                                                                                                                                          Entropy (8bit):3.8673720237532523
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:wMxjIJJ2JoJrsyCmh7VloiIa0QM0ScfSblniT+CC:jjInyur/hUaKln
                                                                                                                                                                                                                          MD5:F745F2F2FDEA14C70EA27BA35D4E3051
                                                                                                                                                                                                                          SHA1:C4F01A629E6BAFB31F722FA65DC92B36D4E61E43
                                                                                                                                                                                                                          SHA-256:EAE97716107B2BF4A14A08DD6197E0542B6EE27C3E12C726FC5BAEF16A144165
                                                                                                                                                                                                                          SHA-512:0E32BE79C2576943D3CB684C2E25EE3970BE7F490FF8FD41BD897249EA560F280933B26B3FBB841C67915A3427CB009A1BFC3DACD70C4F77E33664104E32033E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Simferopol) {. {-9223372036854775808 8184 0 LMT}. {-2840148984 8160 0 SMT}. {-1441160160 7200 0 EET}. {-1247536800 10800 0 MSK}. {-888894000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-811645200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 7200 0 EET}. {694216800 7200 0 EET}. {701820000 10800 1 EEST}. {71754
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.906520812033373
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQawOgpr8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vq3
                                                                                                                                                                                                                          MD5:BB062D4D5D6EA9BA172AC0555227A09C
                                                                                                                                                                                                                          SHA1:75CCA7F75CEB77BE5AFB02943917DB048051F396
                                                                                                                                                                                                                          SHA-256:51820E2C5938CEF89A6ED2114020BD32226EF92102645526352E1CB7995B7D0A
                                                                                                                                                                                                                          SHA-512:8C6AD79DD225C566D2D93606575A1BF8DECF091EDFEED1F10CB41C5464A6A9F1C15BEB4957D76BD1E03F5AE430319480A3FDACEF3116EA2AF0464427468BC855
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Skopje) $TZData(:Europe/Belgrade).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7396
                                                                                                                                                                                                                          Entropy (8bit):3.6373782291014924
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:8lAV/6vcBrYixX21/BVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykePG:8lAV/SEm1/mh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:8B538BB68A7FF0EB541EB2716264BAD9
                                                                                                                                                                                                                          SHA1:49899F763786D4E7324CC5BAAECFEA87D5C4F6C7
                                                                                                                                                                                                                          SHA-256:9D60EF4DBA6D3802CDD25DC87E00413EC7F37777868C832A9E4963E8BCDB103C
                                                                                                                                                                                                                          SHA-512:AD8D75EE4A484050BB108577AE16E609358A9E4F31EA1649169B4A26C8348A502B4135FE3A282A2454799250C6EDF9E70B236BCF23E1F6540E123E39E81BBE41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Sofia) {. {-9223372036854775808 5596 0 LMT}. {-2840146396 7016 0 IMT}. {-2369527016 7200 0 EET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-788922000 3600 0 CET}. {-781048800 7200 0 EET}. {291762000 10800 0 EEST}. {307576800 7200 0 EET}. {323816400 10800 1 EEST}. {339026400 7200 0 EET}. {355266000 10800 1 EEST}. {370393200 7200 0 EET}. {386715600 10800 1 EEST}. {401846400 7200 0 EET}. {417571200 10800 1 EEST}. {433296000 7200 0 EET}. {449020800 10800 1 EEST}. {465350400 7200 0 EET}. {481075200 10800 1 EEST}. {496800000 7200 0 EET}. {512524800 10800 1 EEST}. {528249600 7200 0 EET}. {543974400 10800 1 EEST}. {559699200 7200 0 EET}. {575424000 10800 1 EEST}. {591148800 7200 0 EET}. {606873600 10800 1 EEST}. {622598400 7200 0 EET}. {638323200 10
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7058
                                                                                                                                                                                                                          Entropy (8bit):3.730067397634837
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:K39ucRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:K3HRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:7F6C45358FC5E91125ACBDD46BBD93FE
                                                                                                                                                                                                                          SHA1:C07A80D3C136679751D64866B725CC390D73B750
                                                                                                                                                                                                                          SHA-256:119E9F7B1284462EB8E920E7216D1C219B09A73B323796BBF843346ECD71309A
                                                                                                                                                                                                                          SHA-512:585AE0B1DE1F5D31E45972169C831D837C19D05E21F65FAD3CB84BEF8270C31BF2F635FB803CB70C569FAC2C8AA6ABDE057943F4B51BF1D73B72695FE95ECFD2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Stockholm) {. {-9223372036854775808 4332 0 LMT}. {-2871681132 3614 0 SET}. {-2208992414 3600 0 CET}. {-1692496800 7200 1 CEST}. {-1680483600 3600 0 CET}. {315529200 3600 0 CET}. {323830800 7200 1 CEST}. {338950800 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7295
                                                                                                                                                                                                                          Entropy (8bit):3.6772204206246193
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:dcqDyurGXl6V/DraKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:e7GG16gh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:981078CAEAA994DD0C088B8C4255018A
                                                                                                                                                                                                                          SHA1:5B5E542491FCCC80B04F6F3CA3BA76FEE35BC207
                                                                                                                                                                                                                          SHA-256:716CFFE58847E0084C904A01EF4230F63275660691A4BA54D0B80654E215CC8F
                                                                                                                                                                                                                          SHA-512:3010639D28C7363D0B787F84EF57EE30F457BD8A6A64AEDED1E813EB1AF0A8D85DA0A788C810509F932867F7361B338753CC9B79ACA95D2D32A77F7A8AA8BC9F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tallinn) {. {-9223372036854775808 5940 0 LMT}. {-2840146740 5940 0 TMT}. {-1638322740 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1593824400 5940 0 TMT}. {-1535938740 7200 0 EET}. {-927943200 10800 0 MSK}. {-892954800 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-797648400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 10800 1 EEST}. {622598400 7200 0 EET}. {638
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7412
                                                                                                                                                                                                                          Entropy (8bit):3.7216700074911437
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:6t1WXXRM8DAdRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQlth:6GXh9AdRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:872AB00046280F53657A47D41FBA5EFE
                                                                                                                                                                                                                          SHA1:311BF2342808BD9DC8AB2C2856A1F91F50CFB740
                                                                                                                                                                                                                          SHA-256:D02C2CD894AE4D3C2619A4249088A566B02517FA3BF65DEFAF4280C407E5B5B3
                                                                                                                                                                                                                          SHA-512:2FF901990FA8D6713D875F90FE611E54B35A2216C380E88D408C4FB5BD06916EE804DC6331C117C3AC643731BEADB5BDEDEA0F963B89FAEDB07CA3FFD0B3A535
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Tirane) {. {-9223372036854775808 4760 0 LMT}. {-1767230360 3600 0 CET}. {-932346000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-843519600 3600 0 CET}. {136854000 7200 1 CEST}. {149896800 3600 0 CET}. {168130800 7200 1 CEST}. {181432800 3600 0 CET}. {199839600 7200 1 CEST}. {213141600 3600 0 CET}. {231894000 7200 1 CEST}. {244591200 3600 0 CET}. {263257200 7200 1 CEST}. {276040800 3600 0 CET}. {294706800 7200 1 CEST}. {307490400 3600 0 CET}. {326156400 7200 1 CEST}. {339458400 3600 0 CET}. {357087600 7200 1 CEST}. {370389600 3600 0 CET}. {389142000 7200 1 CEST}. {402444000 3600 0 CET}. {419468400 7200 1 CEST}. {433807200 3600 0 CET}. {449622000 7200 1 CEST}. {457480800 7200 0 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.85845283098493
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV+NM/LpVAIgoq9NM/eO6yQa3MPgJM1p8QagNM/cn:SlSWB9IZaM3ymI6NVAIgoI6eFytM4M8g
                                                                                                                                                                                                                          MD5:743453106E8CD7AE48A2F575255AF700
                                                                                                                                                                                                                          SHA1:7CD6F6DCA61792B4B2CBF6645967B9349ECEACBE
                                                                                                                                                                                                                          SHA-256:C28078D4B42223871B7E1EB42EEB4E70EA0FED638288E9FDA5BB5F954D403AFB
                                                                                                                                                                                                                          SHA-512:458072C7660BEAFEB9AE5A2D3AEA6DA582574D80193C89F08A57B17033126E28A175F5B6E2990034660CAE3BC1E837F8312BC4AA365F426BD54588D0C5A12EB8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Chisinau)]} {. LoadTimeZoneFile Europe/Chisinau.}.set TZData(:Europe/Tiraspol) $TZData(:Europe/Chisinau).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2046
                                                                                                                                                                                                                          Entropy (8bit):3.588329521363201
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cUeRgjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkw/O2blbEUhtCUHiWn0it:EWDTZVemFLN7NBx3Bnu3+ix6b0JiGef
                                                                                                                                                                                                                          MD5:E4394950F7838CD984172D68DA413486
                                                                                                                                                                                                                          SHA1:75F84A4C887463DE3F82C7F0339DD7D71871AA65
                                                                                                                                                                                                                          SHA-256:CB780BBC06F9268CE126461AF9B6539FF16964767A8763479099982214280896
                                                                                                                                                                                                                          SHA-512:7D0E3904300FDD3C4814E15A3C042F3E641BF56AF6867DA7580D1DAD8E07F5B4F0C0717A34E8336C0908D760EDCD48605C7B6BA06A5165BD2BD3AF0B68399C59
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Ulyanovsk) {. {-9223372036854775808 11616 0 LMT}. {-1593820800 10800 0 +03}. {-1247540400 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 18000 1 +05}. {591141600 14400 0 +04}. {606866400 10800 0 +04}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 7200 0 +03}. {670377600 10800 1 +03}. {686102400 7200 0 +02}. {695779200 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7287
                                                                                                                                                                                                                          Entropy (8bit):3.681086026612126
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:DptgbYyurZiVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:Dp4GZNh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:E1088083B0D5570AF8FBE54A4C553AFB
                                                                                                                                                                                                                          SHA1:A6EC8636A0092737829B873C4879E9D4C1B0A288
                                                                                                                                                                                                                          SHA-256:19D87DB3DAB942037935FEC0A9A5E5FE24AFEB1E5F0F1922AF2AF2C2E186621D
                                                                                                                                                                                                                          SHA-512:C58AA37111AE29F85C9C3F1E52DB3C9B2E2DCEFBBB9ACA4C61AD9B00AA7F3A436E754D2285774E882614B16D5DB497ED370A06EE1AFC513579E1E5F1475CA160
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Uzhgorod) {. {-9223372036854775808 5352 0 LMT}. {-2500939752 3600 0 CET}. {-946774800 3600 0 CET}. {-938905200 7200 1 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 1 CEST}. {-794714400 3600 0 CET}. {-773456400 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {631141200 10800 0 MSK}. {646786800 3600 0 CET}. {670384800 7200 0 EET}. {694216800
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.906311228352029
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVnCMPwVAIgoqkCMJW6yQa1NEHp8Qa5CMP:SlSWB9IZaM3ym5XwVAIgo5PyvNEJ8jH
                                                                                                                                                                                                                          MD5:C1817BA53C7CD6BF007A7D1E17FBDFF1
                                                                                                                                                                                                                          SHA1:C72DCD724E24BBE7C22F9279B05EE03924603348
                                                                                                                                                                                                                          SHA-256:E000C8E2A27AE8494DC462D486DC28DAFA502F644FC1540B7B6050EABE4712DC
                                                                                                                                                                                                                          SHA-512:E48C1E1E60233CEC648004B6441F4A49D18D07904F88670A6F9A3DACC3006F7D7CE4A9ACB6C9B6DB8F45CB324EA1BCF6CC3DA8C1FFB40A948BB2231AC4B57EEB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Zurich)]} {. LoadTimeZoneFile Europe/Zurich.}.set TZData(:Europe/Vaduz) $TZData(:Europe/Zurich).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):4.8663121336740405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVvjFwFVAIgoqsuCHRLyQa1xLM1p8Qax9:SlSWB9IZaM3ymx5wFVAIgoxuCxLyvN+a
                                                                                                                                                                                                                          MD5:0652C9CF19CCF5C8210330B22F200D47
                                                                                                                                                                                                                          SHA1:052121E14825CDF98422CAA2CDD20184F184A446
                                                                                                                                                                                                                          SHA-256:3BC0656B5B52E3C3C6B7BC5A53F9228AAFA3EB867982CFD9332B7988687D310B
                                                                                                                                                                                                                          SHA-512:1880524DCA926F4BFD1972E53D5FE616DE18E4A29E9796ABEAEE4D7CD10C6FE79C0D731B305BD4DAA6FC3917B286543D622F2291B76DABA231B9B22A784C7475
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Rome)]} {. LoadTimeZoneFile Europe/Rome.}.set TZData(:Europe/Vatican) $TZData(:Europe/Rome).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7659
                                                                                                                                                                                                                          Entropy (8bit):3.7322931990772257
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:2ntWj6DmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAT:2tWURNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:E8D0D78179D1E9D738CEEC1D0D4943E5
                                                                                                                                                                                                                          SHA1:E0469B86F545FFFA81CE9694C96FE30F33F745DD
                                                                                                                                                                                                                          SHA-256:44FF42A100EA0EB448C3C00C375F1A53614B0B5D468ADF46F2E5EAFF44F7A64C
                                                                                                                                                                                                                          SHA-512:FACA076F44A64211400910E4A7CAD475DD24745ECCE2FE608DD47B0D5BB9221FF15B9D58A767A90FF8D25E0545C3E50B3E464FF80B1D23E934489420640F5C8A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vienna) {. {-9223372036854775808 3921 0 LMT}. {-2422055121 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618700400 3600 0 CET}. {-1577926800 3600 0 CET}. {-1569711600 7200 1 CEST}. {-1555801200 3600 0 CET}. {-938905200 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796777200 3600 0 CET}. {-781052400 7200 1 CEST}. {-780188400 3600 0 CET}. {-757386000 3600 0 CET}. {-748479600 7200 1 CEST}. {-733359600 3600 0 CET}. {-717634800 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {323823600 7200 1 CEST}. {338940000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7233
                                                                                                                                                                                                                          Entropy (8bit):3.682695131194103
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:/FsyurvxXl6V/DAOLl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtk:/fGJ16Oh2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:CF7967CD882413C1423CCD5A1EDC8B2E
                                                                                                                                                                                                                          SHA1:72F5F5D280530A67591FC0F88BF272E2975E173C
                                                                                                                                                                                                                          SHA-256:1E13055C7BF8D7469AFC28B0ED91171D203B382B62F78D140C1CB12CF968637C
                                                                                                                                                                                                                          SHA-512:777B7418FFB8DFE4E6A2B1057BB3CFF2358269044F0E5887260663790D0344BDFD8BF5C220987E30B2D8D391BB96C17C8C5EE86DA83EC4874F7EC3172477DFB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Vilnius) {. {-9223372036854775808 6076 0 LMT}. {-2840146876 5040 0 WMT}. {-1672536240 5736 0 KMT}. {-1585100136 3600 0 CET}. {-1561251600 7200 0 EET}. {-1553565600 3600 0 CET}. {-928198800 10800 0 MSK}. {-900126000 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-802141200 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 7200 0 EEMMTT}. {606873600 10800 1 EEST}. {622598400 7200 0 EET}. {638
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2021
                                                                                                                                                                                                                          Entropy (8bit):3.5806689351967527
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:cRecrebjS+OVkb/cXODnOwUDOS5u8OimFeb/ROHc9qOYNkwLUk+EUhtCUH9mUBUv:YenDTZVemFLN70333+ix6b0JiGE
                                                                                                                                                                                                                          MD5:DFC3D37284F1DCFE802539DB1E684399
                                                                                                                                                                                                                          SHA1:67778FFE4326B1391C3CFE991B3C84C1E9ACA2D2
                                                                                                                                                                                                                          SHA-256:AAFA26F7ED5733A2E45E77D67D7E4E521918CBDC19DAB5BA7774C60B9FDC203F
                                                                                                                                                                                                                          SHA-512:B5A63E363CF9814C6E530840D9BB5A78C36493BAD54060781BACDF10DFA8C95988081DE3364E56D3FDFDBB5A6489E549D8CB1C0B5D1C57F53A1B1915B291A0D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Volgograd) {. {-9223372036854775808 10660 0 LMT}. {-1577761060 10800 0 +03}. {-1247540400 14400 0 +04}. {-256881600 14400 0 +05}. {354916800 18000 1 +05}. {370724400 14400 0 +04}. {386452800 18000 1 +05}. {402260400 14400 0 +04}. {417988800 18000 1 +05}. {433796400 14400 0 +04}. {449611200 18000 1 +05}. {465343200 14400 0 +04}. {481068000 18000 1 +05}. {496792800 14400 0 +04}. {512517600 18000 1 +05}. {528242400 14400 0 +04}. {543967200 18000 1 +05}. {559692000 14400 0 +04}. {575416800 10800 0 +04}. {575420400 14400 1 +04}. {591145200 10800 0 +03}. {606870000 14400 1 +04}. {622594800 10800 0 +03}. {638319600 14400 1 +04}. {654649200 10800 0 +03}. {670374000 14400 0 +04}. {701820000 10800 0 +04}. {701823600 14400 1 +04}. {717548400 10800 0 +03}. {733273200 14400 1 +04}. {748998000 10800 0 +03}. {764722800 14400 1 +04}. {780447
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8366
                                                                                                                                                                                                                          Entropy (8bit):3.731361496484662
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:uOZMLerhW4v4Qzh3VEbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0c:uArhW4v4yENH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:5F72F26A78BECD6702560DE8C7CCB850
                                                                                                                                                                                                                          SHA1:A14E10DCC128B88B3E9C5D2A86DAC7D254CEB123
                                                                                                                                                                                                                          SHA-256:054C1CDABAD91C624A4007D7594C30BE96906D5F29B54C292E0B721F8CB03830
                                                                                                                                                                                                                          SHA-512:564A575EA2FBDB1D262CF55D55BEFC0BF6EF2081D88DE25712B742F5800D2FBE155EDEF0303F62D497BA0E849174F235D8599E09E1C997789E24FE5583F4B0FC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Warsaw) {. {-9223372036854775808 5040 0 LMT}. {-2840145840 5040 0 WMT}. {-1717032240 3600 0 CET}. {-1693706400 7200 1 CEST}. {-1680483600 3600 0 CET}. {-1663455600 7200 1 CEST}. {-1650150000 3600 0 CET}. {-1632006000 7200 1 CEST}. {-1618696800 7200 0 EET}. {-1600473600 10800 1 EEST}. {-1587168000 7200 0 EET}. {-931734000 7200 0 CEST}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-812502000 7200 1 CEST}. {-796870800 7200 0 CEST}. {-796608000 3600 0 CET}. {-778726800 7200 1 CEST}. {-762660000 3600 0 CET}. {-748486800 7200 1 CEST}. {-733273200 3600 0 CET}. {-715215600 7200 1 CEST}. {-701910000 3600 0 CET}. {-684975600 7200 1 CEST}. {-670460400 3600 0 CET}. {-654130800 7200 1 CEST}. {-639010800 3600 0 CET}. {-397094400 7200 1 CEST}. {-386812800 3600 0 CET}. {-371088000 7200 1 CEST}. {-355363200 3600 0
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.851218990240677
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV/sUE2tvFVAIgoq8sUE2vqLyQa5rXv1/h8QahsUE2u:SlSWB9IZaM3ymhrE2tvFVAIgohrE2vqK
                                                                                                                                                                                                                          MD5:445F589A26E47F9D7BDF1A403A96108E
                                                                                                                                                                                                                          SHA1:B119D93796DA7C793F9ED8C5BB8BB65C8DDBFC81
                                                                                                                                                                                                                          SHA-256:6E3ED84BC34D90950D267230661C2EC3C32BA190BD57DDC255F4BE901678B208
                                                                                                                                                                                                                          SHA-512:F45AF9AC0AF800FDCC74DBED1BDFA106A6A58A15308B5B62B4CB6B091FCFD321F156618BE2C157A1A6CAFAAAC399E4C6B590AF7CE7176F757403B55F09842FD2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Belgrade)]} {. LoadTimeZoneFile Europe/Belgrade.}.set TZData(:Europe/Zagreb) $TZData(:Europe/Belgrade).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7238
                                                                                                                                                                                                                          Entropy (8bit):3.6787190163584103
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:Tnh2yurpr2nVaKl9sUM2kNU4tztagAwkY5V778e27zo2yiQ6kjmyykeP2lwtOEZ2:T1Gt2ch2kNU4tB715pyzHy1gA
                                                                                                                                                                                                                          MD5:4AC1F6AB26F3869C757247346BCB72B5
                                                                                                                                                                                                                          SHA1:CB0880906DC630F3C2B934998853CD05AAA1FE39
                                                                                                                                                                                                                          SHA-256:3E9F843F5C6DDBE8E6431BE28ACB95507DDDCA6C521E2FD3355A103BF38F3CB7
                                                                                                                                                                                                                          SHA-512:C4A3AB7B5BA3BC371285654159CB1767ECD52DEDAA61BF69586F6ED61F9F1E877796C28438FF582962C12780484214B5EA670654C87240E01EDD2A4B271EDEEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zaporozhye) {. {-9223372036854775808 8440 0 LMT}. {-2840149240 8400 0 +0220}. {-1441160400 7200 0 EET}. {-1247536800 10800 0 MSK}. {-894769200 3600 0 CET}. {-857257200 3600 0 CET}. {-844556400 7200 1 CEST}. {-828226800 3600 0 CET}. {-826419600 10800 0 MSD}. {354920400 14400 1 MSD}. {370728000 10800 0 MSK}. {386456400 14400 1 MSD}. {402264000 10800 0 MSK}. {417992400 14400 1 MSD}. {433800000 10800 0 MSK}. {449614800 14400 1 MSD}. {465346800 10800 0 MSK}. {481071600 14400 1 MSD}. {496796400 10800 0 MSK}. {512521200 14400 1 MSD}. {528246000 10800 0 MSK}. {543970800 14400 1 MSD}. {559695600 10800 0 MSK}. {575420400 14400 1 MSD}. {591145200 10800 0 MSK}. {606870000 14400 1 MSD}. {622594800 10800 0 MSK}. {638319600 14400 1 MSD}. {654649200 10800 0 MSK}. {670374000 10800 0 EEST}. {686091600 7200 0 EET}. {701820000 10800 1 EEST}. {71
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7055
                                                                                                                                                                                                                          Entropy (8bit):3.732572949993817
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:k7tmcRbjOP9/V+H4Mnb4Nkrloy4xBqffZRgKs0AzxAHTdIVaAq0VZQltUbAyzF76:kbRNH4Mn82rlo6XIZ9ALeBO
                                                                                                                                                                                                                          MD5:D9A3FAE7D9B5C9681D7A98BFACB6F57A
                                                                                                                                                                                                                          SHA1:11268DFEE6D2472B3D8615ED6D70B361521854A2
                                                                                                                                                                                                                          SHA-256:C920B4B7C160D8CEB8A08E33E5727B14ECD347509CABB1D6CDC344843ACF009A
                                                                                                                                                                                                                          SHA-512:7709778B82155FBF35151F9D436F3174C057EBF7927C48F841B1D8AF008EEA9BC181D862A57C436EC69A528FB8B9854D9E974FC9EEC4FFDFE983299102BCDFB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Europe/Zurich) {. {-9223372036854775808 2048 0 LMT}. {-3675198848 1786 0 BMT}. {-2385246586 3600 0 CET}. {-904435200 7200 1 CEST}. {-891129600 3600 0 CET}. {-872985600 7200 1 CEST}. {-859680000 3600 0 CET}. {347151600 3600 0 CET}. {354675600 7200 1 CEST}. {370400400 3600 0 CET}. {386125200 7200 1 CEST}. {401850000 3600 0 CET}. {417574800 7200 1 CEST}. {433299600 3600 0 CET}. {449024400 7200 1 CEST}. {465354000 3600 0 CET}. {481078800 7200 1 CEST}. {496803600 3600 0 CET}. {512528400 7200 1 CEST}. {528253200 3600 0 CET}. {543978000 7200 1 CEST}. {559702800 3600 0 CET}. {575427600 7200 1 CEST}. {591152400 3600 0 CET}. {606877200 7200 1 CEST}. {622602000 3600 0 CET}. {638326800 7200 1 CEST}. {654656400 3600 0 CET}. {670381200 7200 1 CEST}. {686106000 3600 0 CET}. {701830800 7200 1 CEST}. {717555600 3600 0 CET}. {733280400 7200 1 CEST}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):165
                                                                                                                                                                                                                          Entropy (8bit):4.848987525932415
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6wox6QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUwR1O
                                                                                                                                                                                                                          MD5:2639233BCD0119FD601F55F2B6279443
                                                                                                                                                                                                                          SHA1:AADF9931DF78F5BC16ED4638947E77AE52E80CA1
                                                                                                                                                                                                                          SHA-256:846E203E4B40EA7DC1CB8633BF950A8173D7AA8073C186588CC086BC7C4A2BEE
                                                                                                                                                                                                                          SHA-512:8F571F2BBE4C60E240C4EBBB81D410786D1CB8AD0761A99ABB61DDB0811ACC92DCC2F765A7962B5C560B86732286356357D3F408CAC32AC1B2C1F8EAD4AEAEA6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB) $TZData(:Europe/London).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):170
                                                                                                                                                                                                                          Entropy (8bit):4.860435123210029
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxKL82wFVAIgoqyKL8p6w4b/h8QavKL8i:SlSWB9IZaM3ymvKA2wFVAIgovKAUw4bx
                                                                                                                                                                                                                          MD5:51335479044A047F5597F0F06975B839
                                                                                                                                                                                                                          SHA1:234CD9635E61E7D429C70E886FF9C9F707FEAF1F
                                                                                                                                                                                                                          SHA-256:FAC3B11B1F4DA9D68CCC193526C4E369E3FAA74F95C8BEE8BB9FAE014ACD5900
                                                                                                                                                                                                                          SHA-512:4E37EFDFBAFA5C517BE86195373D083FF4370C5031B35A735E3225E7B17A75899FAFFBDF0C8BCFCBC5DC2D037EE9465AD3ED7C0FA55992027DFD69618DC9918F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/London)]} {. LoadTimeZoneFile Europe/London.}.set TZData(:GB-Eire) $TZData(:Europe/London).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):4.817383285510599
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwZ8RDMvn:SlSWB9IZaM3yF4FVAIgJtwZ8RQvn
                                                                                                                                                                                                                          MD5:D19DC8277A68AA289A361D28A619E0B0
                                                                                                                                                                                                                          SHA1:27F5F30CC2603E1BCB6270AF84E9512DADEEB055
                                                                                                                                                                                                                          SHA-256:5B90891127A65F7F3C94B44AA0204BD3F488F21326E098B197FB357C51845B66
                                                                                                                                                                                                                          SHA-512:B5DD9C2D55BDB5909A29FD386CF107B83F56CD9B9F979A5D3854B4112B7F8950F4E91FB86AF6556DCF583EE469470810F3F8FB6CCF04FDBD6625A4346D3CD728
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):150
                                                                                                                                                                                                                          Entropy (8bit):4.868642878112439
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwe7/8RDMvn:SlSWB9IZaM3yF4FVAIgJtwI8RQvn
                                                                                                                                                                                                                          MD5:B5065CD8B1CB665DACDB501797AF5104
                                                                                                                                                                                                                          SHA1:0DB4E9AC6E38632302D9689A0A39632C2592F5C7
                                                                                                                                                                                                                          SHA-256:6FC1D3C727CD9386A11CAF4983A2FC06A22812FDC7752FBFA7A5252F92BB0E70
                                                                                                                                                                                                                          SHA-512:BBA1793CA3BBC768EC441210748098140AE820910036352F5784DD8B2DABA8303BA2E266CB923B500E8F90494D426E8BF115ACD0C000CD0C65896CE7A6AD9D66
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT+0) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):150
                                                                                                                                                                                                                          Entropy (8bit):4.8553095447791055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtw4Hp8RDMvn:SlSWB9IZaM3yF4FVAIgJtw4J8RQvn
                                                                                                                                                                                                                          MD5:E71CDE5E33573E78E01F4B7AB19F5728
                                                                                                                                                                                                                          SHA1:C296752C449ED90AE20F5AEC3DC1D8F329C2274F
                                                                                                                                                                                                                          SHA-256:78C5044C723D21375A1154AE301F29D13698C82B3702042C8B8D1EFF20954078
                                                                                                                                                                                                                          SHA-512:6EBB39EF85DA70833F8B6CCD269346DC015743BC049F6F1B385625C5498F4E953A0CEDE76C60314EE671FE0F6EEB56392D62E0128F5B04BC68681F71718FE2BB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT-0) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149
                                                                                                                                                                                                                          Entropy (8bit):4.843152601955343
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwPHp8RDMvn:SlSWB9IZaM3yF4FVAIgJtwvp8RQvn
                                                                                                                                                                                                                          MD5:FE666CDF1E9AA110A7A0AE699A708927
                                                                                                                                                                                                                          SHA1:0E7FCDA9B47BC1D5F4E0DFAD8A9E7B73D71DC9E3
                                                                                                                                                                                                                          SHA-256:0A883AFE54FAE0ED7D6535BDAB8A767488A491E6F6D3B7813CF76BB32FED4382
                                                                                                                                                                                                                          SHA-512:763591A47057D67E47906AD22270D589100A7380B6F9EAA9AFD9D6D1EE254BCB1471FEC43531C4196765B15F2E27AF9AAB5A688D1C88B45FE7EEA67B6371466E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:GMT0) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):4.869510201987464
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqSsM4DvFVAIgexvqtwE+FB5yRDMvn:SlSWB9IZaM3yF4FVAIgJtwE6BURQvn
                                                                                                                                                                                                                          MD5:F989F3DB0290B2126DA85D78B74E2061
                                                                                                                                                                                                                          SHA1:43A0A1737E1E3EF0501BB65C1E96CE4D0B5635FC
                                                                                                                                                                                                                          SHA-256:41A45FCB805DB6054CD1A4C7A5CFBF82668B3B1D0E44A6F54DFB819E4C71F68A
                                                                                                                                                                                                                          SHA-512:3EDB8D901E04798B566E6D7D72841C842803AE761BEF3DEF37B8CA481E79915A803F61360FA2F317D7BDCD913AF8F5BB14F404E80CFA4A34E4310055C1DF39F2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/GMT)]} {. LoadTimeZoneFile Etc/GMT.}.set TZData(:Greenwich) $TZData(:Etc/GMT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):4.860812879108152
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5/Lm/kXGm2OH1V9i:SlSWB9X5jmTm2OH1V8
                                                                                                                                                                                                                          MD5:3D99F2C6DADF5EEEA4965A04EB17B1BB
                                                                                                                                                                                                                          SHA1:8DF607A911ADF6A9DD67D786FC9198262F580312
                                                                                                                                                                                                                          SHA-256:2C83D64139BFB1115DA3F891C26DD53B86436771A30FB4DD7C8164B1C0D5BCDE
                                                                                                                                                                                                                          SHA-512:EDA863F3A85268BA7A8606E3DCB4D7C88B0681AD8C4CFA1249A22B184F83BFDE9855DD4E5CFC3A4692220E5BEFBF99ED10E13BD98DBCA37D6F29A10AB660EBE2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:HST) {. {-9223372036854775808 -36000 0 HST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.865313867650324
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8LizFVAIgN2qPJL/XF1p4WFKQ1n:SlSWB9IZaM3yWzFVAIgAML//p4wKi
                                                                                                                                                                                                                          MD5:D828C0668A439FEB9779589A646793F8
                                                                                                                                                                                                                          SHA1:1509415B72E2155725FB09615B3E0276F3A46E87
                                                                                                                                                                                                                          SHA-256:CF8BFEC73D36026955FA6F020F42B6360A64ED870A88C575A5AA0CD9756EF51B
                                                                                                                                                                                                                          SHA-512:0F864B284E48B993DD13296AF05AEB14EBE26AF32832058C1FC32FCCE78E85925A25D980052834035D37935FAAF1CB0A9579AECBE6ADCDB2791A134D88204EBF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Hong_Kong)]} {. LoadTimeZoneFile Asia/Hong_Kong.}.set TZData(:Hongkong) $TZData(:Asia/Hong_Kong).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.840758003302018
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqLGsA/8rtdVAIgvMGsA/8rN6+GAKyx/2RQqGsA/8ru:SlSWB9IZaM3yj6dVAIgv1b+XZx+RQj7
                                                                                                                                                                                                                          MD5:18DEAAAC045B4F103F2D795E0BA77B00
                                                                                                                                                                                                                          SHA1:F3B3FE5029355173CD5BA626E075BA73F3AC1DC6
                                                                                                                                                                                                                          SHA-256:9BB28A38329767A22CD073DF34E46D0AA202172A4116FBF008DDF802E60B743B
                                                                                                                                                                                                                          SHA-512:18140274318E913F0650D21107B74C07779B832C9906F1A2E98433B96AAEADF70D07044EB420A2132A6833EF7C3887B8927CFD40D272A13E69C74A63904F43C9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Atlantic/Reykjavik)]} {. LoadTimeZoneFile Atlantic/Reykjavik.}.set TZData(:Iceland) $TZData(:Atlantic/Reykjavik).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.75703014401897
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6EL/liEi2eDcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+LzM2eDkr
                                                                                                                                                                                                                          MD5:1E84F531F7992BFBD53B87831FE349E9
                                                                                                                                                                                                                          SHA1:E46777885945B7C151C6D46C8F7292FC332A5576
                                                                                                                                                                                                                          SHA-256:F4BDCAE4336D22F7844BBCA933795063FA1BCA9EB228C7A4D8222BB07A706427
                                                                                                                                                                                                                          SHA-512:545D6DEB94B7A13D69F387FE758C9FC474DC02703F2D485FD42539D3CE03975CDEEFB985E4AA7742957952AF9E9F1E2DB84389277C3864C32C31D890BD399FB9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Antananarivo) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.802684724729281
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6EL9WJxwFFkXGm2OHi/FvvUcfJ7XH0VQGFr6VVFSTL:SlSWB9X5+LxWJxwFJm2OHqFvd+VQSr6e
                                                                                                                                                                                                                          MD5:4618C8D4F26C02A3A303DD1FB5DCFE46
                                                                                                                                                                                                                          SHA1:857D376F5AFE75784E7F578C83E111B2EE18F74E
                                                                                                                                                                                                                          SHA-256:94262B5A1E3423CD26BFFB3E36F63C1A6880304D00EE5B05985072D82032C765
                                                                                                                                                                                                                          SHA-512:3F5CDDE3D2D5C8BC3DD6423888D7DB6A8EA3D4881ABE9E3857B9D0DDF756D0ECD9CAB7EF66343B0636D32E5CCF0ECEC1F56B9F4BC521CD24B3DB1D935F994AF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Chagos) {. {-9223372036854775808 17380 0 LMT}. {-1988167780 18000 0 +05}. {820436400 21600 0 +06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):4.911693487750565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6EL9FBIEW3v/kXGm2OHAWMx5vXTLyvMVSYvC:SlSWB9X5+LxpW3vTm2OHAnx5PTIMVSYK
                                                                                                                                                                                                                          MD5:5026A59BD9CCD6ABA665B4895EDB0171
                                                                                                                                                                                                                          SHA1:8361778F615EFDDAA660E49545249005B6FC66C3
                                                                                                                                                                                                                          SHA-256:37E1DAD2B019CCD6F8927602B079AD6DB7D71F55CBDA165B0A3EEF580B86DACF
                                                                                                                                                                                                                          SHA-512:E081BDE3FC0D07E75C83C308A662C3A1837A387137BFA8D8E4A59797159F465654BAFFCE6B1458602255BD784CEE0BF70F542C3E893BC87A566630D54084CDCC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Christmas) {. {-9223372036854775808 25372 0 LMT}. {-2364102172 25200 0 +07}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):4.811431467315532
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6EL9d/FkXGm2OHGXTvxoevXmVUXxXW5d6TW8C:SlSWB9X5+LxpJm2OHGXCeP3BG5Uq
                                                                                                                                                                                                                          MD5:4C9502EC642E813E7B699281DD9809DF
                                                                                                                                                                                                                          SHA1:98804A95F13CF4EED983AC019CD1A9EFC01AF719
                                                                                                                                                                                                                          SHA-256:E8C591860DD42374C64E30850A3626017989CF16DDB85FDCC111AD92BD311425
                                                                                                                                                                                                                          SHA-512:8BD7718055789FA7CFB2D50270C563E4D69E16283745701B07073A1CDA271F95B1884F297C2F22CB36EC9983BC759F03B05B39DFD0604CD3278DBCBFB6E12CA6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Cocos) {. {-9223372036854775808 23260 0 LMT}. {-2209012060 23400 0 +0630}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.775639640601132
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6EL9TKlBx+DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+LxGV+Dkr
                                                                                                                                                                                                                          MD5:DAD21C1CD103E6FF24ECB26ECC6CC783
                                                                                                                                                                                                                          SHA1:FBCCCF55EDFC882B6CB003E66B0B7E52A3E0EFDE
                                                                                                                                                                                                                          SHA-256:DA2F64ADC2674BE934C13992652F285927D8A44504327950678AD3B3EC285DCE
                                                                                                                                                                                                                          SHA-512:EA3B155D39D34AFB789F486FAA5F2B327ADB62E43FE5757D353810F9287D9E706773A034D3B2E5F050CCC2A24B31F28A8C44109CCCF43509F2B8547D107FD4A4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Comoro) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):4.822244827214297
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6EL12hJFkXGm2OHvdFFr9vM0VQL:SlSWB9X5+L5Mm2OHlFFr1nVQL
                                                                                                                                                                                                                          MD5:5223EC10BCFBC18A9FA392340530E164
                                                                                                                                                                                                                          SHA1:A59B4F19A3F052B2A3EB57E0D2652E81FB665B50
                                                                                                                                                                                                                          SHA-256:17750D6A9B8ED41809D8DC976777A5252CCB70F39C3BF396B55557A8E504CB09
                                                                                                                                                                                                                          SHA-512:2B2EFC470FE4461F82B1F1909C2A953934938D5DC8B54B2DA3A48678CF23ECD7874187E0FA4F6241FC02AEE0AF29B861C3FEEC15BB90E5C7D3A609DBB50EDC2C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Kerguelen) {. {-9223372036854775808 0 0 -00}. {-631152000 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):143
                                                                                                                                                                                                                          Entropy (8bit):4.873998321422911
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6ELzJMyFkXGm2OHuVdF+YvXTW1U9VsRYvC:SlSWB9X5+L/TJm2OHWgYPhSQC
                                                                                                                                                                                                                          MD5:F8D00BD4AD23557FB4FC8EB095842C26
                                                                                                                                                                                                                          SHA1:AD4AE41D0AD49E80FCF8CADE6889459EA30B57F7
                                                                                                                                                                                                                          SHA-256:997C33DBCEA54DE671A4C4E0E6F931623BF4F39A821F9F15075B9ECCCCA3F1B8
                                                                                                                                                                                                                          SHA-512:F67D348ECCCA244681EE7B70F7815593CFB2D7D4502832B2EB653EBF01AC66ACED29F7EA2E223D295C4D4F64287D372070EF863CCB201ACD8DF470330812013D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mahe) {. {-9223372036854775808 13308 0 LMT}. {-2006653308 14400 0 +04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.833774224054436
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6ELzEyFkXGm2OHnz8evXZT5lxGYUQwGN0VQL:SlSWB9X5+L/EyJm2OHnz8ePZT5rG5QwI
                                                                                                                                                                                                                          MD5:EC0C456538BE81FA83AF440948EED55E
                                                                                                                                                                                                                          SHA1:11D7BA32A38547AF88F4182B6C1C3373AD89D75C
                                                                                                                                                                                                                          SHA-256:18A4B14CD05E4B25431BAF7BFCF2049491BF4E36BB31846D7F18F186C9ECD019
                                                                                                                                                                                                                          SHA-512:FF57F9EDFAD16E32B6A0BA656C5949A0A664D22001D5149BF036C322AEC1682E8B523C8E64E5A49B7EFA535A13459234C16237C09FC5B40F08AC22D56681C4BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Maldives) {. {-9223372036854775808 17640 0 LMT}. {-2840158440 17640 0 MMT}. {-315636840 18000 0 +05}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):262
                                                                                                                                                                                                                          Entropy (8bit):4.450791926516311
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5+L/Hm2OHlNndSvulvSQFFYc0FZFeVhvSQFFbBjvVFZFbGlvSQC:MBp5+L/HmdHlNnS6jz0F7KZjbBjVF7bd
                                                                                                                                                                                                                          MD5:040680E086764FC47EEBE039358E223C
                                                                                                                                                                                                                          SHA1:4D10E6F69835533748DD5FD2E7409F9732221210
                                                                                                                                                                                                                          SHA-256:C4054D56570F9362AB8FF7E4DBA7F8032720289AE01C03A861CCD8DEC9D2ABB2
                                                                                                                                                                                                                          SHA-512:FC00B4AD7328EBC3025A482B3D6A0B176F3430BD3D06B918974EAC5BD30AD8551E0C6BE1DC03BE18A9BC6DD0919ED2A3717E20749ABECBFBD202764047D0D292
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Mauritius) {. {-9223372036854775808 13800 0 LMT}. {-1988164200 14400 0 +04}. {403041600 18000 1 +04}. {417034800 14400 0 +04}. {1224972000 18000 1 +04}. {1238274000 14400 0 +04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.778847657463255
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsVVMMvwVAIgNGExVMSt+L6ELzO1h4DcVVMMv:SlSWB9IZaM3y7VcVAIgNTxL+L/O1h4De
                                                                                                                                                                                                                          MD5:D89C649468B3C22CF5FA659AE590DE53
                                                                                                                                                                                                                          SHA1:83DF2C14F1E51F5B89DCF6B833E421389F9F23DC
                                                                                                                                                                                                                          SHA-256:071D17F347B4EB9791F4929803167497822E899761654053BD774C5A899B4B9C
                                                                                                                                                                                                                          SHA-512:68334E11AAB0F8DCEEB787429832A60F4F0169B6112B7F74048EACFDE78F9C4D100E1E2682D188C3965E41A83477D3AECC80B73A2A8A1A80A952E59B431576A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Nairobi)]} {. LoadTimeZoneFile Africa/Nairobi.}.set TZData(:Indian/Mayotte) $TZData(:Africa/Nairobi).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):4.933616581218054
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5+L6ELsActFkXGm2OHuU7oevUdvcUeNVsRYvC:SlSWB9X5+Lam2OHb7oezfNSQC
                                                                                                                                                                                                                          MD5:C50A592BB886F2FA48657900AE10789F
                                                                                                                                                                                                                          SHA1:16D73BFFDAD18E751968E100BB391AABB29169E1
                                                                                                                                                                                                                          SHA-256:3775EA8EBF5CBBD240E363FB62AEF8D2865A9D9969E40A15731DCC0AC03107EB
                                                                                                                                                                                                                          SHA-512:F875F287E6C3A7B7325DB038CF419AA34FD0072FD3FCD138102008959F397026B647D8D339CB01362330905382FE7DCF5F8EC98C9B8C4FFF59A6FF4E78678BB7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Indian/Reunion) {. {-9223372036854775808 13312 0 LMT}. {-1848886912 14400 0 +04}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):161
                                                                                                                                                                                                                          Entropy (8bit):4.757854680369306
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8g5YFevFVAIgNqjNAt+XiMr4WFKBun:SlSWB9IZaM3yA5owFVAIgcjSt+Xvr4wh
                                                                                                                                                                                                                          MD5:848663FD5F685FE1E14C655A0ABA7D6A
                                                                                                                                                                                                                          SHA1:59A1BEE5B3BE01FB9D2C73777B7B4F1615DCE034
                                                                                                                                                                                                                          SHA-256:DB6D0019D3B0132EF8B8693B1AB2B325D77DE3DD371B1AFDAE4904BE610BA2A6
                                                                                                                                                                                                                          SHA-512:B1F8C08AF68C919DB332E6063647AF15CB9FED4046C16BEF9A58203044E36A0D1E69BD1B8703B15003B929409A8D83238B5AA67B910B920F0674C8A0EB5CF125
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tehran)]} {. LoadTimeZoneFile Asia/Tehran.}.set TZData(:Iran) $TZData(:Asia/Tehran).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):172
                                                                                                                                                                                                                          Entropy (8bit):4.778464205793726
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq85zFFwVAIgN0AzFzt+WXnMr4WFKYzFp:SlSWB9IZaM3yZbwVAIgCAb+zr4wKY7
                                                                                                                                                                                                                          MD5:B9D1F6BD0B0416791036C0E3402C8438
                                                                                                                                                                                                                          SHA1:E1A7471062C181B359C06804420091966B809957
                                                                                                                                                                                                                          SHA-256:E6EC28F69447C3D3DB2CB68A51EDCEF0F77FF4B563F7B65C9C71FF82771AA3E1
                                                                                                                                                                                                                          SHA-512:A5981FD91F6A9A84F44A6C9A3CF247F9BE3AB52CE5FE8EE1A7BE19DD63D0B22818BC15287FE73A5EEC8BCE6022B9EAF54A10AA719ADF31114E188F31EA273E92
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Jerusalem)]} {. LoadTimeZoneFile Asia/Jerusalem.}.set TZData(:Israel) $TZData(:Asia/Jerusalem).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.668645988954937
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx00EIECpVAIg200EIEvvt9S//2IAcGE0EIEVn:SlSWB9IZaM3y7952VAIgp95vF029095V
                                                                                                                                                                                                                          MD5:EA38E93941E21CB08AA49A023DCC06FB
                                                                                                                                                                                                                          SHA1:1AD77CAC25DC6D1D04320FF2621DD8E7D227ECBF
                                                                                                                                                                                                                          SHA-256:21908F008F08C55FB48F1C3D1A1B2016BDB10ED375060329451DE4E487CF0E5F
                                                                                                                                                                                                                          SHA-512:D6F0684A757AD42B8010B80B4BE6542ADE96D140EC486B4B768E167502C776B8D289622FBC48BD19EB3D0B3BC4156715D5CCFC7952A479A990B07935B15D26DC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Jamaica)]} {. LoadTimeZoneFile America/Jamaica.}.set TZData(:Jamaica) $TZData(:America/Jamaica).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):159
                                                                                                                                                                                                                          Entropy (8bit):4.791469556628492
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8aowVAIgNqaF9hM7/4WFK6n:SlSWB9IZaM3ypwVAIgcaF4r4wK6n
                                                                                                                                                                                                                          MD5:338A18DEDF5A813466644B2AAE1A7CF5
                                                                                                                                                                                                                          SHA1:BB76CE671853780F4971D2E173AE71E82EA24690
                                                                                                                                                                                                                          SHA-256:535AF1A79CD01735C5D6FC6DB08C5B0EAFB8CF0BC89F7E943CF419CFA745CA26
                                                                                                                                                                                                                          SHA-512:4D44CC28D2D0634200FEA0537EBC5DD50E639365B89413C6BF911DC2B95B78E27F1B92733FB859C794A8C027EA89E45E8C2D6E1504FF315AF68DB02526226AD2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Tokyo)]} {. LoadTimeZoneFile Asia/Tokyo.}.set TZData(:Japan) $TZData(:Asia/Tokyo).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.759848173726549
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG1/EOM2wFVAIgObT1/EOM8O68/FMKpUDH1/EOMi:SlSWB9IZaM3yc1EiwFVAIgOb1E48xME+
                                                                                                                                                                                                                          MD5:A9C8CA410CA3BD4345BF6EAB53FAB97A
                                                                                                                                                                                                                          SHA1:57AE7E6D3ED855B1FBF6ABF2C9846DFA9B3FFF47
                                                                                                                                                                                                                          SHA-256:A63A99F0E92F474C4AA99293C4F4182336520597A86FCDD91DAE8B25AFC30B98
                                                                                                                                                                                                                          SHA-512:C97CF1301DCEEE4DE26BCEEB60545BB70C083CD2D13ED89F868C7856B3532473421599ED9E7B166EA53A9CF44A03245192223D47BC1104CEBD1BF0AC6BF10898
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Kwajalein)]} {. LoadTimeZoneFile Pacific/Kwajalein.}.set TZData(:Kwajalein) $TZData(:Pacific/Kwajalein).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):4.779409803819657
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqsbKJqYkdVAIgNGEnKJuYvW67beDcbKJ9n:SlSWB9IZaM3y7JdVAIgNTnYvW6PeD9n
                                                                                                                                                                                                                          MD5:C4739F7B58073CC7C72EF2D261C05C5E
                                                                                                                                                                                                                          SHA1:12FE559CA2FEA3F8A6610B1D4F43E299C9FB7BA5
                                                                                                                                                                                                                          SHA-256:28A94D9F1A60980F8026409A65F381EDB7E5926A79D07562D28199B6B63AF9B4
                                                                                                                                                                                                                          SHA-512:B2DC5CB1AD7B6941F498FF3D5BD6538CAF0ED19A2908DE645190A5C5F40AF5B34752AE8A83E6C50D370EA619BA969C9AB7F797F171192200CDA1657FFFB7F05A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Africa/Tripoli)]} {. LoadTimeZoneFile Africa/Tripoli.}.set TZData(:Libya) $TZData(:Africa/Tripoli).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7471
                                                                                                                                                                                                                          Entropy (8bit):3.7115445412724797
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:TJOwNDgaXSgm7VTslzZBYxWq9beN6db6yq3BgLjx1uuE0KRPGdNjClOQuonZ2ltb:bSV7xxWq9aYdbsC/eLdGLg9a
                                                                                                                                                                                                                          MD5:2F62D867C8605730BC8E43D300040D54
                                                                                                                                                                                                                          SHA1:06AD982DF03C7309AF01477749BAB9F7ED8935A7
                                                                                                                                                                                                                          SHA-256:D6C70E46A68B82FFC7A4D96FDA925B0FAAF973CB5D3404A55DFF2464C3009173
                                                                                                                                                                                                                          SHA-512:0D26D622511635337E5C03D82435A9B4A9BCA9530F940A70A24AE67EA4794429A5D68B59197B978818BEF0799C3D5FA792F5720965291661ED067570BC56226B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:MET) {. {-9223372036854775808 3600 0 MET}. {-1693706400 7200 1 MEST}. {-1680483600 3600 0 MET}. {-1663455600 7200 1 MEST}. {-1650150000 3600 0 MET}. {-1632006000 7200 1 MEST}. {-1618700400 3600 0 MET}. {-938905200 7200 1 MEST}. {-857257200 3600 0 MET}. {-844556400 7200 1 MEST}. {-828226800 3600 0 MET}. {-812502000 7200 1 MEST}. {-796777200 3600 0 MET}. {-781052400 7200 1 MEST}. {-766623600 3600 0 MET}. {228877200 7200 1 MEST}. {243997200 3600 0 MET}. {260326800 7200 1 MEST}. {276051600 3600 0 MET}. {291776400 7200 1 MEST}. {307501200 3600 0 MET}. {323830800 7200 1 MEST}. {338950800 3600 0 MET}. {354675600 7200 1 MEST}. {370400400 3600 0 MET}. {386125200 7200 1 MEST}. {401850000 3600 0 MET}. {417574800 7200 1 MEST}. {433299600 3600 0 MET}. {449024400 7200 1 MEST}. {465354000 3600 0 MET}. {481078800 7200 1 MEST}. {496803600 3600 0 MET
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):106
                                                                                                                                                                                                                          Entropy (8bit):4.856431808856169
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx56xwkXGm2OHrXV4fvYv:SlSWB9X562m2OHrCi
                                                                                                                                                                                                                          MD5:FF6BDAC2C77D8287B46E966480BFEACC
                                                                                                                                                                                                                          SHA1:4C90F910C74E5262A27CC65C3433D34B5D885243
                                                                                                                                                                                                                          SHA-256:FB6D9702FC9FB82779B4DA97592546043C2B7D068F187D0F79E23CB5FE76B5C2
                                                                                                                                                                                                                          SHA-512:CA197B25B36DD47D86618A4D39BFFB91FEF939BC02EEB96679D7EA88E5D38737D3FE6BD4FD9D16C31CA5CF77D17DC31E5333F4E28AB777A165050EA5A4D106BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:MST) {. {-9223372036854775808 -25200 0 MST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8227
                                                                                                                                                                                                                          Entropy (8bit):3.755606924782105
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:xG5c2sGm+4I1zXN+C2mWBNQMsmNTxf6AeO+cblX:12dVUC2mWBNwWTxyWR
                                                                                                                                                                                                                          MD5:2AB5643D8EF9FD9687A5C67AEB04AF98
                                                                                                                                                                                                                          SHA1:2E8F1DE5C8113C530E5E6C10064DEA4AE949AAE6
                                                                                                                                                                                                                          SHA-256:97028B43406B08939408CB1DD0A0C63C76C9A352AEA5F400CE6D4B8D3C68F500
                                                                                                                                                                                                                          SHA-512:72A8863192E14A4BD2E05C508F8B376DD75BB4A3625058A97BBB33F7200B2012D92D445982679E0B7D11C978B80F7128B3A79B77938CEF6315AA6C4B1E0AC09C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:MST7MDT) {. {-9223372036854775808 -25200 0 MST}. {-1633273200 -21600 1 MDT}. {-1615132800 -25200 0 MST}. {-1601823600 -21600 1 MDT}. {-1583683200 -25200 0 MST}. {-880210800 -21600 1 MWT}. {-769395600 -21600 1 MPT}. {-765388800 -25200 0 MST}. {-84380400 -21600 1 MDT}. {-68659200 -25200 0 MST}. {-52930800 -21600 1 MDT}. {-37209600 -25200 0 MST}. {-21481200 -21600 1 MDT}. {-5760000 -25200 0 MST}. {9968400 -21600 1 MDT}. {25689600 -25200 0 MST}. {41418000 -21600 1 MDT}. {57744000 -25200 0 MST}. {73472400 -21600 1 MDT}. {89193600 -25200 0 MST}. {104922000 -21600 1 MDT}. {120643200 -25200 0 MST}. {126694800 -21600 1 MDT}. {152092800 -25200 0 MST}. {162378000 -21600 1 MDT}. {183542400 -25200 0 MST}. {199270800 -21600 1 MDT}. {215596800 -25200 0 MST}. {230720400 -21600 1 MDT}. {247046400 -25200 0 MST}. {262774800 -21600 1 MDT}. {278496000 -252
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):185
                                                                                                                                                                                                                          Entropy (8bit):4.836487818373659
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0qfSwVAIg20qfo6AdMSKBbh4IAcGEqfu:SlSWB9IZaM3y7eHVAIgpeo68K5h490eu
                                                                                                                                                                                                                          MD5:C3AEEA7B991B609A1CB253FDD5057D11
                                                                                                                                                                                                                          SHA1:0212056C2A20DD899FA4A26B10C261AB19D20AA4
                                                                                                                                                                                                                          SHA-256:599F79242382ED466925F61DD6CE59192628C7EAA0C5406D3AA98EC8A5162824
                                                                                                                                                                                                                          SHA-512:38094FD29B1C31FC9D894B8F38909DD9ED3A76B2A27F6BC250ACD7C1EFF4529CD0B29B66CA7CCBEB0146DFF3FF0AC4AEEEC422F7A93422EF70BF723D12440A93
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Tijuana)]} {. LoadTimeZoneFile America/Tijuana.}.set TZData(:Mexico/BajaNorte) $TZData(:America/Tijuana).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):186
                                                                                                                                                                                                                          Entropy (8bit):4.841665860441288
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0zjRJ+vFVAIg20zjRJZvt6AdMPCoQIAcGEzjRJ3:SlSWB9IZaM3y7zjRJQFVAIgpzjRJ1t6n
                                                                                                                                                                                                                          MD5:89A5ED35215BA46C76BF2BD5ED620031
                                                                                                                                                                                                                          SHA1:26F134644023A2D0DA4C8997C54E36C053AA1060
                                                                                                                                                                                                                          SHA-256:D624945E20F30CCB0DB2162AD3129301E5281B8868FBC05ACA3AA8B6FA05A9DF
                                                                                                                                                                                                                          SHA-512:C2563867E830F7F882E393080CE16A62A0CDC5841724E0D507CBA362DB8363BB75034986107C2428243680FE930BAC226E11FE6BA99C31E0C1A35D6DD1C14676
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mazatlan)]} {. LoadTimeZoneFile America/Mazatlan.}.set TZData(:Mexico/BajaSur) $TZData(:America/Mazatlan).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):195
                                                                                                                                                                                                                          Entropy (8bit):4.8300311016675606
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7zBDdVAIgpzBy6BXl490zBw:MBaIMYzipzU6Bi90zi
                                                                                                                                                                                                                          MD5:E771850BA5A1C218EB1B31FDC564DF02
                                                                                                                                                                                                                          SHA1:3675838740B837A96FF32694D1FA56DE01DE064F
                                                                                                                                                                                                                          SHA-256:06A45F534B35538F32A77703C6523CE947D662D136C5EC105BD6616922AEEB44
                                                                                                                                                                                                                          SHA-512:BD7AF307AD61C310EDAF01E618BE9C1C79239E0C8CDEC85792624A7CCE1B6251B0ADE066B8610AFDB0179F3EF474503890642284800B81E599CB830EC6C7C9AA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Mexico_City)]} {. LoadTimeZoneFile America/Mexico_City.}.set TZData(:Mexico/General) $TZData(:America/Mexico_City).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.8398862338201765
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG/u4pVAIgObT/NCxL5E1nUDH/uvn:SlSWB9IZaM3ycqIVAIgOboLivn
                                                                                                                                                                                                                          MD5:7B274C782E9FE032AC4B3E137BF147BB
                                                                                                                                                                                                                          SHA1:8469D17EC75D0580667171EFC9DE3FDF2C1E0968
                                                                                                                                                                                                                          SHA-256:2228231C1BEF0173A639FBC4403B6E5BF835BF5918CC8C16757D915A392DBF75
                                                                                                                                                                                                                          SHA-512:AE72C1F244D9457C70A120FD00F2C0FC2BDC467DBD5C203373291E00427499040E489F2B1358757EA281BA8143E28FB54D03EDE67970F74DACFCB308AC7F74CE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Auckland)]} {. LoadTimeZoneFile Pacific/Auckland.}.set TZData(:NZ) $TZData(:Pacific/Auckland).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.832832776993659
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG9WQ+DdVAIgObT9WQrF5AmtBFB/pUDH9WQpn:SlSWB9IZaM3ycwQ+DdVAIgObwQ5zzJjA
                                                                                                                                                                                                                          MD5:C8D83C210169F458683BB35940E11DF6
                                                                                                                                                                                                                          SHA1:278546F4E33AD5D0033AF6768EFAB0DE247DA74F
                                                                                                                                                                                                                          SHA-256:CECF81746557F6F957FEF12DBD202151F614451F52D7F6A35C72B830075C478D
                                                                                                                                                                                                                          SHA-512:4539AE6F7AF7579C3AA5AE4DEB97BD14ED83569702D3C4C3945DB06A2D8FFF260DA1DB21FF21B0BED91EE9C993833D471789B3A99C9A2986B7AC8ABFBBE5A8B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chatham)]} {. LoadTimeZoneFile Pacific/Chatham.}.set TZData(:NZ-CHAT) $TZData(:Pacific/Chatham).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):172
                                                                                                                                                                                                                          Entropy (8bit):4.80475858956378
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0L5vf1+IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLpd+90+u
                                                                                                                                                                                                                          MD5:38C56298E75306F39D278F60B50711A6
                                                                                                                                                                                                                          SHA1:8FD9CEAD17CCD7D981CEF4E782C3916BFEF2D11F
                                                                                                                                                                                                                          SHA-256:E10B8574DD83C93D3C49E9E2226148CBA84538802316846E74DA6004F1D1534D
                                                                                                                                                                                                                          SHA-512:F6AA67D78A167E553B97F092CC3791B591F800A6D286BE37C06F7ECABDFBCF43A397AEDC6E3EB9EB6A1CB95E8883D4D4F97890CA1877930AFCD5643B0C8548E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:Navajo) $TZData(:America/Denver).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):166
                                                                                                                                                                                                                          Entropy (8bit):4.854287452296565
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8qvwVAIgNtAnL75h4WFKdv:SlSWB9IZaM3yMwVAIgEH5h4wKt
                                                                                                                                                                                                                          MD5:AF9DD8961DB652EE1E0495182D99820D
                                                                                                                                                                                                                          SHA1:979602E3C59719A67DE3C05633242C12E0693C43
                                                                                                                                                                                                                          SHA-256:9A6109D98B35518921E4923B50053E7DE9B007372C5E4FFF75654395D6B56A82
                                                                                                                                                                                                                          SHA-512:F022C3EFABFC3B3D3152C345ACD28387FFEA4B61709CBD42B2F3684D33BED469C4C25F2328E5E7D9D74D968E25A0419E7BCFF0EB55650922906B9D3FF57B06C8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Shanghai)]} {. LoadTimeZoneFile Asia/Shanghai.}.set TZData(:PRC) $TZData(:Asia/Shanghai).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8227
                                                                                                                                                                                                                          Entropy (8bit):3.751820462019181
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:9d89jJC2ZCHtffWsBNwj/lpmlOxGcKcnRH31t+ucgge:49jgNf+aNwj/lpmlOxnKcndIG
                                                                                                                                                                                                                          MD5:DB5250A28A3853951AF00231677AACAC
                                                                                                                                                                                                                          SHA1:1FC1DA1121B9F5557D246396917205B97F6BC295
                                                                                                                                                                                                                          SHA-256:4DFC264F4564957F333C0208DA52DF03301D2FD07943F53D8B51ECCDD1CB8153
                                                                                                                                                                                                                          SHA-512:72594A17B1E29895A6B4FC636AAE1AB28523C9C8D50118FA5A7FDFD3944AD3B742B17B260A69B44756F4BA1671268DD3E8223EF314FF7850AFB81202BA2BBF44
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:PST8PDT) {. {-9223372036854775808 -28800 0 PST}. {-1633269600 -25200 1 PDT}. {-1615129200 -28800 0 PST}. {-1601820000 -25200 1 PDT}. {-1583679600 -28800 0 PST}. {-880207200 -25200 1 PWT}. {-769395600 -25200 1 PPT}. {-765385200 -28800 0 PST}. {-84376800 -25200 1 PDT}. {-68655600 -28800 0 PST}. {-52927200 -25200 1 PDT}. {-37206000 -28800 0 PST}. {-21477600 -25200 1 PDT}. {-5756400 -28800 0 PST}. {9972000 -25200 1 PDT}. {25693200 -28800 0 PST}. {41421600 -25200 1 PDT}. {57747600 -28800 0 PST}. {73476000 -25200 1 PDT}. {89197200 -28800 0 PST}. {104925600 -25200 1 PDT}. {120646800 -28800 0 PST}. {126698400 -25200 1 PDT}. {152096400 -28800 0 PST}. {162381600 -25200 1 PDT}. {183546000 -28800 0 PST}. {199274400 -25200 1 PDT}. {215600400 -28800 0 PST}. {230724000 -25200 1 PDT}. {247050000 -28800 0 PST}. {262778400 -25200 1 PDT}. {278499600 -288
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5431
                                                                                                                                                                                                                          Entropy (8bit):3.5627170055641306
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:2DBgcGFG9qbhX7zHJ4uoyM/15WNQ+NyVy:2DBgcGFGkXxaD/CR
                                                                                                                                                                                                                          MD5:6718CD07DCEBD2CA85FC1764BE45E46C
                                                                                                                                                                                                                          SHA1:0BCD2E4267F2BDB499EA613C17B9C38CCFC2177A
                                                                                                                                                                                                                          SHA-256:5D3D1B4180482099119383DC160520DCDA5D4E3EEC87F22EA20B7D4B599F5249
                                                                                                                                                                                                                          SHA-512:95C16BC92B9B3C80F9FA10F5B49DAEB472D45C2489A455A31177A8679E21EF668F85450E1770CFB77CA43477B68EF11B3A4090C11CE6F7FA518040EA7B502855
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Apia) {. {-9223372036854775808 45184 0 LMT}. {-2445424384 -41216 0 LMT}. {-1861878784 -41400 0 -1130}. {-631110600 -39600 0 -11}. {1285498800 -36000 1 -11}. {1301752800 -39600 0 -11}. {1316872800 -36000 1 -11}. {1325239200 50400 0 +13}. {1333202400 46800 0 +13}. {1348927200 50400 1 +13}. {1365256800 46800 0 +13}. {1380376800 50400 1 +13}. {1396706400 46800 0 +13}. {1411826400 50400 1 +13}. {1428156000 46800 0 +13}. {1443276000 50400 1 +13}. {1459605600 46800 0 +13}. {1474725600 50400 1 +13}. {1491055200 46800 0 +13}. {1506175200 50400 1 +13}. {1522504800 46800 0 +13}. {1538229600 50400 1 +13}. {1554559200 46800 0 +13}. {1569679200 50400 1 +13}. {1586008800 46800 0 +13}. {1601128800 50400 1 +13}. {1617458400 46800 0 +13}. {1632578400 50400 1 +13}. {1648908000 46800 0 +13}. {1664028000 50400 1 +13}. {1680357600 46800 0 +13}. {169
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8487
                                                                                                                                                                                                                          Entropy (8bit):3.8173754903771018
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:WNj7nBIc0fw4eJ7a1N1oKe13aNiWbF8sYBpYhuVn:Cmc3J7a1N18QOs8
                                                                                                                                                                                                                          MD5:6C008D6437C7490EE498605B5B096FDB
                                                                                                                                                                                                                          SHA1:D7F6E7B3920C54EFE02A44883DBCD0A75C7FC46A
                                                                                                                                                                                                                          SHA-256:B5BD438B748BA911E0E1201A83B623BE3F8130951C1377D278A7E7BC9CB7F672
                                                                                                                                                                                                                          SHA-512:DA6992D257B1BA6124E39F90DDEE17DC3E2F3B38C3A68B77A93065E3E5873D28B8AE5D21CEC223BAADFBDD1B3A735BF1CEC1BDEB0C4BEAB72AAA23433A707207
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Auckland) {. {-9223372036854775808 41944 0 LMT}. {-3192435544 41400 0 NZMT}. {-1330335000 45000 1 NZST}. {-1320057000 41400 0 NZMT}. {-1300699800 43200 1 NZST}. {-1287396000 41400 0 NZMT}. {-1269250200 43200 1 NZST}. {-1255946400 41400 0 NZMT}. {-1237800600 43200 1 NZST}. {-1224496800 41400 0 NZMT}. {-1206351000 43200 1 NZST}. {-1192442400 41400 0 NZMT}. {-1174901400 43200 1 NZST}. {-1160992800 41400 0 NZMT}. {-1143451800 43200 1 NZST}. {-1125914400 41400 0 NZMT}. {-1112607000 43200 1 NZST}. {-1094464800 41400 0 NZMT}. {-1081157400 43200 1 NZST}. {-1063015200 41400 0 NZMT}. {-1049707800 43200 1 NZST}. {-1031565600 41400 0 NZMT}. {-1018258200 43200 1 NZST}. {-1000116000 41400 0 NZMT}. {-986808600 43200 1 NZST}. {-968061600 41400 0 NZMT}. {-955359000 43200 1 NZST}. {-936612000 41400 0 NZMT}. {-923304600 43200 1 NZST}. {-757425600 43200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):270
                                                                                                                                                                                                                          Entropy (8bit):4.659789664861683
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5Ftgm2OHHhp5PZiuoDZDVeXU8vScCv/yZEiIv:MBp5FtgmdHf5PZiDZJek8HCvK6iIv
                                                                                                                                                                                                                          MD5:A85F8A9502E818ADE7759166B9C7A9AD
                                                                                                                                                                                                                          SHA1:5E706E5491AFE1A8399D7815158924381A1F6D27
                                                                                                                                                                                                                          SHA-256:C910696B4CC7CA3E713EE08A024D26C1E4E4003058DECD5B54B92A0B2F8A17E0
                                                                                                                                                                                                                          SHA-512:682BDC7DA0C9BFFD98992973295E180FB3FAACEA514760211B5291AEE26CABF200B68CA0EA80D9083C52F32C2EE3D0A5E84141363D1784C2A6A9FD24C2CF38E9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Bougainville) {. {-9223372036854775808 37336 0 LMT}. {-2840178136 35312 0 PMMT}. {-2366790512 36000 0 +10}. {-868010400 32400 0 +09}. {-768906000 36000 0 +10}. {1419696000 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7907
                                                                                                                                                                                                                          Entropy (8bit):3.5670394561999235
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:1zwIBIWUkebw49ikidrGlb0D6DALquK8KfStVt:1jIbw49ikiAcWuB
                                                                                                                                                                                                                          MD5:5DF25A6A6E7322528FE41B6FD5FE5119
                                                                                                                                                                                                                          SHA1:E84915BA27443F01243050D648DF6388A1E8EDBA
                                                                                                                                                                                                                          SHA-256:B6727010950418F6FC142658C74EE1D717E7FD2B46267FC215E53CA3D55E894E
                                                                                                                                                                                                                          SHA-512:842ABE39AB26713D523A36895D7435DC2058846431CB2A0B7B47E204F8C315ADB855F95EC2852D57B73ECA0576CB1A49BB104C0D7BB9DE2E96143DA9C77F9A58
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chatham) {. {-9223372036854775808 44028 0 LMT}. {-3192437628 44100 0 +1215}. {-757426500 45900 0 +1245}. {152632800 49500 1 +1245}. {162309600 45900 0 +1245}. {183477600 49500 1 +1245}. {194968800 45900 0 +1245}. {215532000 49500 1 +1245}. {226418400 45900 0 +1245}. {246981600 49500 1 +1245}. {257868000 45900 0 +1245}. {278431200 49500 1 +1245}. {289317600 45900 0 +1245}. {309880800 49500 1 +1245}. {320767200 45900 0 +1245}. {341330400 49500 1 +1245}. {352216800 45900 0 +1245}. {372780000 49500 1 +1245}. {384271200 45900 0 +1245}. {404834400 49500 1 +1245}. {415720800 45900 0 +1245}. {436284000 49500 1 +1245}. {447170400 45900 0 +1245}. {467733600 49500 1 +1245}. {478620000 45900 0 +1245}. {499183200 49500 1 +1245}. {510069600 45900 0 +1245}. {530632800 49500 1 +1245}. {541519200 45900 0 +1245}. {562082400 49500 1 +1245}. {5735736
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):145
                                                                                                                                                                                                                          Entropy (8bit):4.989695428683993
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH9CoFeEXGm2OHIOYvXmdcnWZUUJv:SlSWB9X5ZzLm2OHNYPmdcXQ
                                                                                                                                                                                                                          MD5:61C075090B025E69800B23E0AD60459F
                                                                                                                                                                                                                          SHA1:F847CA6D35BD4AF2C70B318D4EE4A2FB5C77D449
                                                                                                                                                                                                                          SHA-256:3237743592D8719D0397FA278BB501E6F403985B643D1DE7E2DA91DD11BE215B
                                                                                                                                                                                                                          SHA-512:5D07FB2FEAA9110D62CFD95BC729AA57F2A176C977D2E2C00374AF36EE84C4FB9416ECBEF179298928AAE9634B69C5FE889C5C9D2DFF290CAC0F6E53EDEC1A48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Chuuk) {. {-9223372036854775808 36428 0 LMT}. {-2177489228 36000 0 +10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7935
                                                                                                                                                                                                                          Entropy (8bit):3.4518545894421475
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OX45AGaHe2Y9btlqStWdmPndSy//TQMpeQkZyYbK6HdtLQOXJ/+:OX45AGdT9ZtWdmPnZ/TQfbbKsXJ2
                                                                                                                                                                                                                          MD5:9B0B358E33E33FEFE38BEF73232919F3
                                                                                                                                                                                                                          SHA1:7164F24730A37875128BE3F2FB4E9BC076AB9F39
                                                                                                                                                                                                                          SHA-256:E02B71C59DF59109D12EBE60ED153922F1DFF3F5C4AD207E267AB025792C51F4
                                                                                                                                                                                                                          SHA-512:A0C4A98B0B40FDE690A8EEE7A2C2F16C3E70C6F406FF0699B98CB837C72C6A1259395167795F2CFBBD2943E602AC0483C62B9D6209B8258018F7D78E103BBB15
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Easter) {. {-9223372036854775808 -26248 0 LMT}. {-2524495352 -26248 0 EMT}. {-1178124152 -25200 0 -07}. {-36619200 -21600 1 -07}. {-23922000 -25200 0 -07}. {-3355200 -21600 1 -07}. {7527600 -25200 0 -07}. {24465600 -21600 1 -07}. {37767600 -25200 0 -07}. {55915200 -21600 1 -07}. {69217200 -25200 0 -07}. {87969600 -21600 1 -07}. {100666800 -25200 0 -07}. {118209600 -21600 1 -07}. {132116400 -25200 0 -07}. {150868800 -21600 1 -07}. {163566000 -25200 0 -07}. {182318400 -21600 1 -07}. {195620400 -25200 0 -07}. {213768000 -21600 1 -07}. {227070000 -25200 0 -07}. {245217600 -21600 1 -07}. {258519600 -25200 0 -07}. {277272000 -21600 1 -07}. {289969200 -25200 0 -07}. {308721600 -21600 1 -07}. {321418800 -25200 0 -07}. {340171200 -21600 1 -07}. {353473200 -25200 0 -07}. {371620800 -21600 1 -07}. {384922800 -21600 0 -06}. {403070400 -180
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):705
                                                                                                                                                                                                                          Entropy (8bit):4.002147979275868
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5cJmdH6mv6kJ2RX/x6DydjX2tHcsXFX2hE5zuGqptxv:cuesUMkGdXWF3A
                                                                                                                                                                                                                          MD5:48DEC5B1A9AADA4F09D03FEB037A2FE8
                                                                                                                                                                                                                          SHA1:6D25E80F0570236565F098DD0A637F546957F117
                                                                                                                                                                                                                          SHA-256:4F9AC8B0FE89990E8CF841EED9C05D92D53568DE772247F70A70DC11CBD78532
                                                                                                                                                                                                                          SHA-512:0FA4693F3FDAB12DB04B6D50E0782A352CF95A7C2765CF1906BAA35355755E324E1B17005DF3748DBE42743FE824AE983316958B2EC0A9B0B7D136BEC06AB983
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Efate) {. {-9223372036854775808 40396 0 LMT}. {-1829387596 39600 0 +11}. {433256400 43200 1 +11}. {448977600 39600 0 +11}. {467298000 43200 1 +11}. {480427200 39600 0 +11}. {496760400 43200 1 +11}. {511876800 39600 0 +11}. {528210000 43200 1 +11}. {543931200 39600 0 +11}. {559659600 43200 1 +11}. {575380800 39600 0 +11}. {591109200 43200 1 +11}. {606830400 39600 0 +11}. {622558800 43200 1 +11}. {638280000 39600 0 +11}. {654008400 43200 1 +11}. {669729600 39600 0 +11}. {686062800 43200 1 +11}. {696340800 39600 0 +11}. {719931600 43200 1 +11}. {727790400 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):208
                                                                                                                                                                                                                          Entropy (8bit):4.767926806075848
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5Vm2OH1oePmWXytFBVyv7fPfTVVFmv:MBp5VmdH15PZsBVyDXfZvY
                                                                                                                                                                                                                          MD5:D7EE7623A410715B1F34DC06F5400996
                                                                                                                                                                                                                          SHA1:1ADD299AB66A0BCC32D92EAFBC2CA3B277E1FA3D
                                                                                                                                                                                                                          SHA-256:8CAF3AE352EC168BC0C948E788BB3CBFE3991F36A678A24B47711543D450AED8
                                                                                                                                                                                                                          SHA-512:356C3ECC40211B36FA1ECF8601AA8FAAE8080606F55AA4E706D239B8EE35ADE3987708716376D73053DB7A59B9A9B7A267EEDA6ED2A80A558FABA48E851C0EB1
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Enderbury) {. {-9223372036854775808 -41060 0 LMT}. {-2177411740 -43200 0 -12}. {307627200 -39600 0 -11}. {788871600 46800 0 +13}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):178
                                                                                                                                                                                                                          Entropy (8bit):4.865240332098143
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH4ErKYvcXGm2OH18VkevXmUENBBdNiCPFVFv74v:SlSWB9X5BE3Lm2OH1VePmH7fP+v
                                                                                                                                                                                                                          MD5:6CC11F5FAA361F69262AB8E7F4DB4F90
                                                                                                                                                                                                                          SHA1:EA7ED940C0A3B5941972439DE1D735B4DC4AE0AA
                                                                                                                                                                                                                          SHA-256:21C4C35919A24CD9C80BE1BD51C6714AA7EBF447396B3A2E63D330D905FA9945
                                                                                                                                                                                                                          SHA-512:152709462F29EE14A727BE625E7ABD59625B6C4D4B36A2CE76B68D96CD176EDECA91DF26DAC553346ED360F2CA0F6C62981F50B088AE7BE1B998B425D91EF3B5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fakaofo) {. {-9223372036854775808 -41096 0 LMT}. {-2177411704 -39600 0 -11}. {1325242800 46800 0 +13}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5505
                                                                                                                                                                                                                          Entropy (8bit):3.545141446818078
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:9ebtKf1V/ncXDwwn+q5Y6h+ueDJyqm5DHzv:EbIf1V/nGD5n+q5YPO
                                                                                                                                                                                                                          MD5:67BE85DD77F7B520FD5705A4412157E3
                                                                                                                                                                                                                          SHA1:04FA33692B8DBB8DDF89EF790646A0535943953D
                                                                                                                                                                                                                          SHA-256:2FE87FF4AEBB58506B4E2552D3CB66AAC1D038D8C62F8C70B0EAF1CC508EC9FA
                                                                                                                                                                                                                          SHA-512:35D4C46D187912D2B39C07A50DB0C56427ACF3755AD4B563B734BE26CA9C441AA0C2836266C803919786BF6DA9118A880CCF221FE9F9A9E30D610BE8E4913A9F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Fiji) {. {-9223372036854775808 42944 0 LMT}. {-1709985344 43200 0 +12}. {909842400 46800 1 +12}. {920124000 43200 0 +12}. {941896800 46800 1 +12}. {951573600 43200 0 +12}. {1259416800 46800 1 +12}. {1269698400 43200 0 +12}. {1287842400 46800 1 +12}. {1299333600 43200 0 +12}. {1319292000 46800 1 +12}. {1327154400 43200 0 +12}. {1350741600 46800 1 +12}. {1358604000 43200 0 +12}. {1382796000 46800 1 +12}. {1390050000 43200 0 +12}. {1414850400 46800 1 +12}. {1421503200 43200 0 +12}. {1446300000 46800 1 +12}. {1452952800 43200 0 +12}. {1478354400 46800 1 +12}. {1484402400 43200 0 +12}. {1509804000 46800 1 +12}. {1515852000 43200 0 +12}. {1541253600 46800 1 +12}. {1547301600 43200 0 +12}. {1572703200 46800 1 +12}. {1579356000 43200 0 +12}. {1604152800 46800 1 +12}. {1610805600 43200 0 +12}. {1636207200 46800 1 +12}. {1642255200 43200
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):4.974991227981989
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH4QwyFtXGm2OHwodGevXmcpXrWXVN0UIvYv:SlSWB9X5BCEm2OHwxePmgSX0a
                                                                                                                                                                                                                          MD5:23994D1C137B8BC2BA6E97739B38E7BD
                                                                                                                                                                                                                          SHA1:36772677B3C869C49A829AF08486923321ADD50A
                                                                                                                                                                                                                          SHA-256:F274C6CD08E5AA46FDEA219095DA8EA60DA0E95E5FD1CBCB9E6611DE47980F9E
                                                                                                                                                                                                                          SHA-512:CB2DB35960D11322AD288912C5D82C8C579791E40E510A90D34AAB20136B17AA019EFD55D1C4A2D9E88F7AF79F15779AF7EC6856F3085161AC84C93872C61176
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Funafuti) {. {-9223372036854775808 43012 0 LMT}. {-2177495812 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):238
                                                                                                                                                                                                                          Entropy (8bit):4.63034174284777
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5fEjFJm2OHvQYezie7KV9dRncRviWFrN5/uFfXFfrin:MBp5fSFJmdH0zV7O9DdWFN5/uFfXdGn
                                                                                                                                                                                                                          MD5:307B016C9E6A915B1760D9A6AD8E63C1
                                                                                                                                                                                                                          SHA1:26B797811821C09CF6BAB76E05FF612359DF7318
                                                                                                                                                                                                                          SHA-256:F1CB2B1EBD4911857F5F183E446A22E731BD57925AD07B15CA78A7BDDFED611F
                                                                                                                                                                                                                          SHA-512:F7AAAEE32CAC84F7D54C29E07CB8952D61585B85CB4FFFB93DD824A71403FDF356EC0761E5EEE19D9F8139F11A9CAB0A7DAEADBD13B6DD4C0CDF9FB573794542
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Galapagos) {. {-9223372036854775808 -21504 0 LMT}. {-1230746496 -18000 0 -05}. {504939600 -21600 0 -06}. {722930400 -18000 1 -06}. {728888400 -21600 0 -06}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149
                                                                                                                                                                                                                          Entropy (8bit):4.931482658662627
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH5hBfcXGm2OHKToxYvUdNfiuvn:SlSWB9X5kTm2OHPxYYquv
                                                                                                                                                                                                                          MD5:98754C9D99442282F5C911725764C5D1
                                                                                                                                                                                                                          SHA1:7E679DC38A7C7873695E10814B04E3919D1BFB41
                                                                                                                                                                                                                          SHA-256:7D09014BE33CB2B50554B6937B3E870156FDCB5C36E9F8E8925711E79C12FC74
                                                                                                                                                                                                                          SHA-512:2044AEEDFEF948E502667D1C60E22814202E4BA657DE89A962B6E9E160A93B3B77BF0AC4F5159FC45D43B2038E624D90A4589FB87F3449CA10D350EF60373D17
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Gambier) {. {-9223372036854775808 -32388 0 LMT}. {-1806678012 -32400 0 -09}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):151
                                                                                                                                                                                                                          Entropy (8bit):4.934129846149006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH5RyJTLJyFkXGm2OHddHvpoxYvUdMWdHPVmv:SlSWB9X5LJHgm2OHdFGxYAHPAv
                                                                                                                                                                                                                          MD5:193872CE34E69F8B499203BC70C2639B
                                                                                                                                                                                                                          SHA1:7A2B8E346E3BF3BE48AAA330C3EEE47332E994AB
                                                                                                                                                                                                                          SHA-256:F1D21C339E8155711AA7EF9F4059A738A8A4CE7A6B78FFDD8DCC4AC0DB5A0010
                                                                                                                                                                                                                          SHA-512:D2114AD27922799B8C38B0486D1FAE838EC94A461388960A6F2D19F7763E09FF75A9C4619C52BE2626E8EA2275794B694C1A76E2711D10B77CE6E34259DBF2BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guadalcanal) {. {-9223372036854775808 38388 0 LMT}. {-1806748788 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):204
                                                                                                                                                                                                                          Entropy (8bit):4.833752908914461
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5bm2OHauezyRtAePmdSUUyWGHZFUeMn:MBp5bmdHanzCtBP1yWleMn
                                                                                                                                                                                                                          MD5:AD14439D9E27F2D3545E17082150DC75
                                                                                                                                                                                                                          SHA1:43DE1D4A90ABE54320583FAB46E6F9B428C0B577
                                                                                                                                                                                                                          SHA-256:CE4D3D493E625DA15A8B4CD3008D9CBDF20C73101C82F4D675F5B773F4A5CF70
                                                                                                                                                                                                                          SHA-512:77800323ED5AF49DA5E6314E94938BEAAEDD69BB61E338FAF024C3A22747310307A13C6CBBAFE5A48164855B238C2CAD354426F0EE7201B4FB5C129D68CB0E3B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Guam) {. {-9223372036854775808 -51660 0 LMT}. {-3944626740 34740 0 LMT}. {-2177487540 36000 0 GST}. {977493600 36000 0 ChST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):332
                                                                                                                                                                                                                          Entropy (8bit):4.582125163058844
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5PeQm2OHsVVPBraX3UNFvDrUXaWFvjHovLnvRY7p0:MBp5WQmdH0VPBa0VOT12G7O
                                                                                                                                                                                                                          MD5:17ACB888B597247CB0CA3CA191E51640
                                                                                                                                                                                                                          SHA1:9C2668BF0288D277ED2FE5DBCD5C34F5931004A6
                                                                                                                                                                                                                          SHA-256:719EA0BC1762078A405936791C65E4255B4250FB2B305342FE768A21D6AF34BE
                                                                                                                                                                                                                          SHA-512:9D02F784F0CD2195AEDEAA59E3ECD64B27928D48DCBC3EA2651B36B3BE7F8C6D9CBB66ACDC76DC02D94DF19C0A29306DD8C2A15AD89C24188FC3E4BCFBE6D456
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Honolulu) {. {-9223372036854775808 -37886 0 LMT}. {-2334101314 -37800 0 HST}. {-1157283000 -34200 1 HDT}. {-1155436200 -34200 0 HST}. {-880201800 -34200 1 HWT}. {-769395600 -34200 1 HPT}. {-765376200 -37800 0 HST}. {-712150200 -36000 0 HST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188
                                                                                                                                                                                                                          Entropy (8bit):4.795254976384326
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNnUDH0KNyFx/hpUDH2fe:SlSWB9IZaM3yc6e8dVAIgOb6ezvNNWya
                                                                                                                                                                                                                          MD5:FA20CE420C5370C228EB169BBC083EFB
                                                                                                                                                                                                                          SHA1:5B4C221AC97292D5002F6ABEB6BC66D7B8E2F01B
                                                                                                                                                                                                                          SHA-256:83A14BF52D181B3229603393EA90B9535A2FF05E3538B8C9AD19F483E6447C09
                                                                                                                                                                                                                          SHA-512:7E385FEBD148368F192FC6B1D5E4B8DD31F58EC4329BF9820D554E97402D0A582AB2EBCF46A5151D0167333349A83476BEB11C49BC0EBAADE5A297C42879E0C3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:Pacific/Johnston) $TZData(:Pacific/Honolulu).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):211
                                                                                                                                                                                                                          Entropy (8bit):4.684652862044272
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH1meEXGm2OHjToevXmUBepRGFz4vQU8F/5f5vARVvVtQCn:SlSWB9X5iLm2OHjkePmLSz4YjRfSzvJn
                                                                                                                                                                                                                          MD5:E22A2C0F847601F128986A48A4B72F90
                                                                                                                                                                                                                          SHA1:4E1D047DC64AA57C311A22FB1DA8497CD7022192
                                                                                                                                                                                                                          SHA-256:88260F34784960C229B2B282F8004FD1AF4BE1BC2883AAEE7D041A622933C3FE
                                                                                                                                                                                                                          SHA-512:A80DAC1A2A3376A47E2A542DE92CCC733E440AF2F05A70823DA52A2490FC9D1762F35CE256E6D1F7CCD435EEFBD6B0FBC533459CD3AD79ACD52C7CA78C29317C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kiritimati) {. {-9223372036854775808 -37760 0 LMT}. {-2177415040 -38400 0 -1040}. {307622400 -36000 0 -10}. {788868000 50400 0 +14}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):201
                                                                                                                                                                                                                          Entropy (8bit):4.763096849699127
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDH1+AtFkXGm2OHHvvXmc03VLpCcfzvwX0UIv4Q9Hmv:SlSWB9X598Jm2OHHvPmb9fLYX01Yv
                                                                                                                                                                                                                          MD5:96235B4DD81BA681216B74046A5A8780
                                                                                                                                                                                                                          SHA1:24D682CE5D7C4A3DF8C860CB80ED262085CB965C
                                                                                                                                                                                                                          SHA-256:BE400ED502FA7EC34B8DE44B2A3D0AF3033292EF08FD1F5F276147E15460CFF6
                                                                                                                                                                                                                          SHA-512:4B30A0A1806D5D96FE5F9B1208490E23EABB498B634C98D89553059E68292AAAB6B182FE367E2923DBE0BC03D023D9EFC0EC25F5DD19AB8AE878B32478FF4B55
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kosrae) {. {-9223372036854775808 39116 0 LMT}. {-2177491916 39600 0 +11}. {-7988400 43200 0 +12}. {915105600 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):205
                                                                                                                                                                                                                          Entropy (8bit):4.788662012960935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5yErm2OH4T2ePmvfL/XytdrH0a:MBp5XrmdHWPoL8rUa
                                                                                                                                                                                                                          MD5:885C86BCE6B3D83D9CD715D75170AA81
                                                                                                                                                                                                                          SHA1:9607AC6B1756FEBF2BEC2A78138AF12C11FD46F6
                                                                                                                                                                                                                          SHA-256:2E636A3576119F2976D2029E75F26A060A5C0800BF7B719F1CB4562D896A6432
                                                                                                                                                                                                                          SHA-512:410D32CBAB0C1B9D948C2C1416B6D158650600748F1C96D16121DB5F0A9D8384A14067E8603576ED1101BD62F6529C6E7A129428B77CBA1D185214D051F2C6B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Kwajalein) {. {-9223372036854775808 40160 0 LMT}. {-2177492960 39600 0 +11}. {-7988400 -43200 0 -12}. {745848000 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):173
                                                                                                                                                                                                                          Entropy (8bit):4.868505550342842
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHznHLXGm2OHy3HuxYvXmcQ/VpCcfzvwX0UIvYv:SlSWB9X5Qim2OHyexYPmf/ffLYX0a
                                                                                                                                                                                                                          MD5:5664FAB6368844F8139F48C32A1486B9
                                                                                                                                                                                                                          SHA1:55826443FB44D44B5331082568E2C46257A0F726
                                                                                                                                                                                                                          SHA-256:CBBB814CE6E9F2FA1C8F485BBDB0B759FDA8C859BC989EC28D4756CC10B21A82
                                                                                                                                                                                                                          SHA-512:1BD1D6C2224E0DCC7A1887ECEB38C64E8DEABF44BE52FE29C5A302BAD95C0EB9DBD20E5738F3916B8902FA084606E07BE3723C1BE62416EB1E6DC4AD215A56F0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Majuro) {. {-9223372036854775808 41088 0 LMT}. {-2177493888 39600 0 +11}. {-7988400 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):153
                                                                                                                                                                                                                          Entropy (8bit):4.930595315407702
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHzrHeHkXGm2OHOx5vUdNpNFvvIVVCC:SlSWB9X5cHeLm2OHOnY/FvQVVL
                                                                                                                                                                                                                          MD5:B41251BE6A78B9BA4F7859D344517738
                                                                                                                                                                                                                          SHA1:8C0DFDD40B8AE1DFA6C3C1BDD44E8452F5EE49E1
                                                                                                                                                                                                                          SHA-256:FC06B45FB8C5ED081BAFA999301354722AEF17DB2A9C58C6CDF81C758E63D899
                                                                                                                                                                                                                          SHA-512:96D302EAA274BEE26325B8334DA8C3782B8DC0E279DDF464D281AF2B0CEE19E9254837A4B1D08F9B777BE892F639D205F6AB85C37C8F8B58A4867EA082FF054B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Marquesas) {. {-9223372036854775808 -33480 0 LMT}. {-1806676920 -34200 0 -0930}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):189
                                                                                                                                                                                                                          Entropy (8bit):4.763101291800624
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHz0HvUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiZeg
                                                                                                                                                                                                                          MD5:A5A67AC85621952E16528DD73C94346E
                                                                                                                                                                                                                          SHA1:FB3D1AD833CD77B8FE68AC37FAA39FF4A9A69815
                                                                                                                                                                                                                          SHA-256:B4C19E4D05CCBC73ABE5389EBCFCC5586036C1D2275434003949E1CF634B9C26
                                                                                                                                                                                                                          SHA-512:5BB96561582BA3E9F2973322BCF76BD3F9023EC965A0CB504DFE13C127CA2ED562D040EC033DDB946FBB17E9FDD2EAB7532F88B2B0F1182CE880E41C920CFD36
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Midway) $TZData(:Pacific/Pago_Pago).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):235
                                                                                                                                                                                                                          Entropy (8bit):4.6089214752758965
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5Jem2OHceR6sCHST0ikvScCdpShcX0a:MBp5JemdH9sxZHCDEta
                                                                                                                                                                                                                          MD5:CBC3FE6B512B0A3E96B7F47E4CD830EB
                                                                                                                                                                                                                          SHA1:A1962DF38BED723F8F747B8931B57FAAC2E8291C
                                                                                                                                                                                                                          SHA-256:8118062E25736A4672B11D6A603B5A8FE2ED1A82E1814261DF087EA3071A7DD7
                                                                                                                                                                                                                          SHA-512:18E0975189794068033AD000D6A3DA8859EDAAE9D546969AB683399031888307D3F52909DCFEB637CF719782D4F5E87D49A73D6D4B53DEF6FD98041B7A046686
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Nauru) {. {-9223372036854775808 40060 0 LMT}. {-1545131260 41400 0 +1130}. {-877347000 32400 0 +09}. {-800960400 41400 0 +1130}. {294323400 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):209
                                                                                                                                                                                                                          Entropy (8bit):4.680590339435768
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5Jm3Lm2OHJPm60jdFBJNsYv8FyGv7Kn:MBp5JmbmdHJPB0mYRGDKn
                                                                                                                                                                                                                          MD5:54FD41634DDEAA58F9F9770DC82B3E5F
                                                                                                                                                                                                                          SHA1:E5296ACE7239C4CD7E13D391676F910376556ACC
                                                                                                                                                                                                                          SHA-256:9D4E202A1ED8609194A97ED0F58B3C36DF83F46AE92EAF09F8337317DCACA75F
                                                                                                                                                                                                                          SHA-512:9A2192C1232368FA5D382062A2C48869155B727C970F5D5BCD5FE424FC9D15417394E637D77FCA793B633517A1BFED8D93E74F239A3BC1A6716615B6D877ADC6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Niue) {. {-9223372036854775808 -40780 0 LMT}. {-2177412020 -40800 0 -1120}. {-599575200 -41400 0 -1130}. {276089400 -39600 0 -11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):269
                                                                                                                                                                                                                          Entropy (8bit):4.580350938236725
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5JJpkLm2OH6uToePmUOvJiQHSJE8Gy+xS7zzv:MBp5JJAmdH6SPIvVH787+xkv
                                                                                                                                                                                                                          MD5:147E5FF4670F8551895B7B0EC1A66D46
                                                                                                                                                                                                                          SHA1:83F0D4DC817ED61E7985CC7AB3268B3EBAD657A3
                                                                                                                                                                                                                          SHA-256:A56472811F35D70F95E74A7366297BFAAFBC034CD10E9C0F3C59EFFA21A74223
                                                                                                                                                                                                                          SHA-512:FE183CA00E7D2B79F8E81E1FAF5E8CE103E430B7159C14CA915FD2BFE6D4381BF42EDB217E9D99C13D728CD09BB0E67562E84D957E9606F6B6C1AB08657DDBF9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Norfolk) {. {-9223372036854775808 40312 0 LMT}. {-2177493112 40320 0 +1112}. {-599656320 41400 0 +1130}. {152029800 45000 1 +1230}. {162912600 41400 0 +1130}. {1443882600 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):314
                                                                                                                                                                                                                          Entropy (8bit):4.468119357525684
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9X5JcdJm2OHTYAfIX2pVzOa9FxpZPS62pm+v:MBp5JcLmdHTYJX2fzFjb123v
                                                                                                                                                                                                                          MD5:A966877A1BEBFE5125460233A5C26728
                                                                                                                                                                                                                          SHA1:721103E2BFC0991CE80708D77C3FBEDCC2B3C9D3
                                                                                                                                                                                                                          SHA-256:8C282AC6DA722858D8B1755C710BE3EC4BD8EFEF4832A415E772EED287899315
                                                                                                                                                                                                                          SHA-512:51B5BD7834D4B3BAEEF3E1A2E6F469F6FFC354407182CA87AF67C4F4F26D4CB116A60BBB08BC178950CA3CFF978E2809EFC73002A4F8883B454024A2FFCBD732
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Noumea) {. {-9223372036854775808 39948 0 LMT}. {-1829387148 39600 0 +11}. {250002000 43200 1 +11}. {257342400 39600 0 +11}. {281451600 43200 1 +11}. {288878400 39600 0 +11}. {849366000 43200 1 +11}. {857228400 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.94008377236012
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHurKeTFwSXGm2OH2ivkevXUPi1TsYvUdfWTVvvL:SlSWB9X5XevJm2OH23ePWieYCWZvvL
                                                                                                                                                                                                                          MD5:7ABD13E51C01A85468F6511B6710E4B5
                                                                                                                                                                                                                          SHA1:9DC80A7BFD7028DB672A20EF32C31B11F083BA99
                                                                                                                                                                                                                          SHA-256:AEE9D8FBCB7413536DA1CBDC4F28B7863B3DDD5E6A5AB2A90CE32038AC0EA2B8
                                                                                                                                                                                                                          SHA-512:6F6BBEBB10FD6B3987D3076D93DC06F5F765FAC22A90C4184AAF33C1FFD4CBD98464C8A0B4C0C38808AA6D08F91F5060BCEC83E278B8BEF21124C7FE427A09AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pago_Pago) {. {-9223372036854775808 45432 0 LMT}. {-2445424632 -40968 0 LMT}. {-1861879032 -39600 0 SST}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):145
                                                                                                                                                                                                                          Entropy (8bit):4.920441332270432
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHugEZFwcXGm2OHCAnvXmdQ4+vScCC:SlSWB9X5Xg2wTm2OHPnPmdQRvScCC
                                                                                                                                                                                                                          MD5:4070C7A615EF7977537641B01FA46AD6
                                                                                                                                                                                                                          SHA1:E80FF2BBD448B2399DBE56D279858D7D06EBA691
                                                                                                                                                                                                                          SHA-256:F12CB444E9BA91385BED20E60E7DF1A0DB0CE76C6FC7ACA59EEF029BC56D5EA3
                                                                                                                                                                                                                          SHA-512:5DD3FD1D0AA4D6DA3F274BEEC283A72B4532804AA9901AB4B1616D36C13CB8F5CC51DB8A6B89C019FAD875ABB567EFC8BD894AADC1E63E94A8CAC79F3E82CB6C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Palau) {. {-9223372036854775808 32276 0 LMT}. {-2177485076 32400 0 +09}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.757588870650609
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHuQTWLMWkXGm2OHUVFvvXmXUlgloRNycyf/vGRvn:SlSWB9X5XQyLMCm2OHUVVPmXUKmOhf/+
                                                                                                                                                                                                                          MD5:AB8D0D9514FA6C5E995AE76D2DAEA6D4
                                                                                                                                                                                                                          SHA1:3775349B3BE806AA005174D91597D6F2C54E8EC5
                                                                                                                                                                                                                          SHA-256:3BB856B2C966211D7689CD303DFDDACB3C323F3C2DA0FF47148A8C5B7BC0E1C4
                                                                                                                                                                                                                          SHA-512:AB5D2E00C820D36A2A8B198AAC9350BEFA235EA848A11B16B042EE8124975DCAFC737D30D7C1A01D874B0937E469C2364441FCA686B5EB66A48251F587F55DC5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pitcairn) {. {-9223372036854775808 -31220 0 LMT}. {-2177421580 -30600 0 -0830}. {893665800 -28800 0 -08}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):147
                                                                                                                                                                                                                          Entropy (8bit):4.9618148014469705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHuy3EXGm2OH1/VvXmcrLmv:SlSWB9X5Xybm2OH1NPmSqv
                                                                                                                                                                                                                          MD5:0D8489972CBD248971C83DA074C79030
                                                                                                                                                                                                                          SHA1:3E390EDC1A2F678918220026F03E914BB6E8ED4B
                                                                                                                                                                                                                          SHA-256:A85364C6E79EA16FD0C86A5CF74CCB84843009A6738AAED3B13A709F1BDF0DF7
                                                                                                                                                                                                                          SHA-512:A43E459BAB47F133E27A67CFA448E94FBE796DDC23A2D6C3400437D3BC8F31AC2EF3541C4588CF494E1BBD55856C5FA8553A6CD92534E2243EFA31BE2BF5A4CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Pohnpei) {. {-9223372036854775808 37972 0 LMT}. {-2177490772 39600 0 +11}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.735143778298082
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQGuySedVAIgObTuyvQnUDHu3HppUDHuyu:SlSWB9IZaM3yciySedVAIgObiyvQX3HP
                                                                                                                                                                                                                          MD5:C963ECC06914E8E42F0B96504C1F041C
                                                                                                                                                                                                                          SHA1:82D256793B22E9C07362708EE262A6B46AC13ACD
                                                                                                                                                                                                                          SHA-256:86593D3A9DC648370A658D82DA7C410E26D818DB2749B79F57A802F8CED76BD3
                                                                                                                                                                                                                          SHA-512:0F3691977F992A3FF281AD1577BA0BD4AAF7DB3F167E1A1FF139374C14B14F1A456BE7E7D362D698A8294A6AB906E69AC56E1EE0DAF77C13050553299FB6DAF5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pohnpei)]} {. LoadTimeZoneFile Pacific/Pohnpei.}.set TZData(:Pacific/Ponape) $TZData(:Pacific/Pohnpei).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.8981931494123065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHuwKXI3EXGm2OHwdvvXZUeQTnoowFZnqMVVMUJv:SlSWB9X5X/43Lm2OHwdvPZZQTnoDZDVN
                                                                                                                                                                                                                          MD5:AF14EE836FE5D358C83568C5ACFA88C0
                                                                                                                                                                                                                          SHA1:22026C7FE440E466193E6B6935C2047BD321F76B
                                                                                                                                                                                                                          SHA-256:33E0A5DD919E02B7311A35E24DB37F86A20A394A195FE01F5A3BE7336F276665
                                                                                                                                                                                                                          SHA-512:BEF151E1198D57328BA0FC01BB6F00AD51ADEEE99A97C30E0D08FFB3CFCB9E99B34DBAD03FCB3B19F17D60590FA0E6C5F2978954A3585CDFD31E32C93B05154D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Port_Moresby) {. {-9223372036854775808 35320 0 LMT}. {-2840176120 35312 0 PMMT}. {-2366790512 36000 0 +10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):907
                                                                                                                                                                                                                          Entropy (8bit):3.848488423299009
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:ccekzUF0tMUObNFnNUYWJYu+nkonSAOaJT/rbkoa5SBnLn:1zUuMUOnNUVJYxkonSAOaJTjbkoasRLn
                                                                                                                                                                                                                          MD5:19F22E22F7B136EFCB45E83BC765E871
                                                                                                                                                                                                                          SHA1:500CC7EA47902856727C2B6D23BF4DAFF6817EB4
                                                                                                                                                                                                                          SHA-256:B1235ED60A50282E14F4B2B477F9936D15CAF91495CBB81971A2C9580209C420
                                                                                                                                                                                                                          SHA-512:2FD667F105E57A62821B2BB301A1A31BB56FA6670AADC94F41337445335262FE40DA5DAE7113328E54379E45246B5419B94F8C8AFB73B1F2405E7F08F5D6FBCC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Rarotonga) {. {-9223372036854775808 -38344 0 LMT}. {-2177414456 -37800 0 -1030}. {279714600 -34200 0 -10}. {289387800 -36000 0 -10}. {309952800 -34200 1 -10}. {320837400 -36000 0 -10}. {341402400 -34200 1 -10}. {352287000 -36000 0 -10}. {372852000 -34200 1 -10}. {384341400 -36000 0 -10}. {404906400 -34200 1 -10}. {415791000 -36000 0 -10}. {436356000 -34200 1 -10}. {447240600 -36000 0 -10}. {467805600 -34200 1 -10}. {478690200 -36000 0 -10}. {499255200 -34200 1 -10}. {510139800 -36000 0 -10}. {530704800 -34200 1 -10}. {541589400 -36000 0 -10}. {562154400 -34200 1 -10}. {573643800 -36000 0 -10}. {594208800 -34200 1 -10}. {605093400 -36000 0 -10}. {625658400 -34200 1 -10}. {636543000 -36000 0 -10}. {657108000 -34200 1 -10}. {667992600 -36000 0 -10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.8048918219164065
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG5RFedVAIgObT5RSQnUDHtluKpUDH5Rp:SlSWB9IZaM3ycdedVAIgObaQvKM
                                                                                                                                                                                                                          MD5:BE50B3EE2BD083842CFFB7698DD04CDE
                                                                                                                                                                                                                          SHA1:0B8C8AFC5F94E33226F148202EFFBD0787D61FA2
                                                                                                                                                                                                                          SHA-256:74DD6FE03E3061CE301FF3E8E309CF1B10FC0216EEC52839D48B210BCBD8CF63
                                                                                                                                                                                                                          SHA-512:136BCF692251B67CD3E6922AD0A200F0807018DC191CAE853F2192FD385F8150D5CCF36DF641ED9C09701E4DBBB105BF97C7540D7FA9D9FFC440682B770DF5BA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Guam)]} {. LoadTimeZoneFile Pacific/Guam.}.set TZData(:Pacific/Saipan) $TZData(:Pacific/Guam).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188
                                                                                                                                                                                                                          Entropy (8bit):4.729839728044672
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAtnUDHthA5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiNXeg
                                                                                                                                                                                                                          MD5:843BBE96C9590D69B09FD885B68DE65A
                                                                                                                                                                                                                          SHA1:25BF176717A4578447E1D77F9BF0140AFF18625A
                                                                                                                                                                                                                          SHA-256:4F031CB2C27A3E311CA4450C20FB5CF4211A168C39591AB02EEEC80A5A8BFB93
                                                                                                                                                                                                                          SHA-512:B50301CFC8E5CF8C257728999B0D91C06E2F7C040D30F71B90BBC612959B519E8D27EE2DA9B8B9002483D3F4F173BB341A07898B4E4C98A146B3D988CA3BD5B2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:Pacific/Samoa) $TZData(:Pacific/Pago_Pago).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):4.900317309402027
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHqhFtXGm2OHl/oevUdNqRU8Cn:SlSWB9X5TTEm2OHloeYqRQn
                                                                                                                                                                                                                          MD5:DDF599B7659B88603DF80E390471CB10
                                                                                                                                                                                                                          SHA1:80FF5E0E99483CB8952EC137A261D034B6759D07
                                                                                                                                                                                                                          SHA-256:B8282EC1E5BFA5E116C7DC5DC974B0605C85D423519F124754126E8F8FE439EC
                                                                                                                                                                                                                          SHA-512:28F15CB6310190066936B7B21024205EC87A54D081415B1E46E72982814E1E2A41A2CE8B808D02E705100CE5ACBB1E69F1859E40A04F629B7004FBD89DD37899
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tahiti) {. {-9223372036854775808 -35896 0 LMT}. {-1806674504 -36000 0 -10}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):4.924466748251822
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHqQwcXGm2OHyyFpoevXmciRrWFN0UIvYv:SlSWB9X5TbTm2OHyyFGePmbu0a
                                                                                                                                                                                                                          MD5:AE5E0FFFEEFD0A8E77233CB0E59DE352
                                                                                                                                                                                                                          SHA1:7B7CC1095FB919946F3315C4A28994AEB1ECD51A
                                                                                                                                                                                                                          SHA-256:1FCC6C0CC48538EDB5B8290465156B2D919DFA487C740EB85A1DF472C460B0E6
                                                                                                                                                                                                                          SHA-512:1693FA5DE78FDCF79993CB137EE0568A4B8245D0177DF845356B3C2418641C8AA23CAA7069707C0E180FF9F5345D380A3575EEFFE0C8BC08E18E40ED0E1F6FA3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tarawa) {. {-9223372036854775808 41524 0 LMT}. {-2177494324 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):436
                                                                                                                                                                                                                          Entropy (8bit):4.271209640478309
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12:MBp5kJmdHmLP72Dcw8UtnKbUtrtAUt54bUtjg:cOem77il2eQ
                                                                                                                                                                                                                          MD5:C32CDBF9C696134870351ABB80920E08
                                                                                                                                                                                                                          SHA1:43918B7BF46EF2B574D684D36901592E43A45A8A
                                                                                                                                                                                                                          SHA-256:8FE5EF266C660C4A25827BE9C2C4081A206D946DD46EBC1095F8D18F41536399
                                                                                                                                                                                                                          SHA-512:1E10C548659A9CE0A9F0C7E6FD86EAD8627C07A8C9842933E7C6CD28EACDE3735DBFDCF7DD1DE5DDE7F2F102F7D584B3C44B1350AFDF7E1621FE9F565CD32362
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Tongatapu) {. {-9223372036854775808 44360 0 LMT}. {-2177497160 44400 0 +1220}. {-915193200 46800 0 +13}. {915102000 46800 0 +13}. {939214800 50400 1 +13}. {953384400 46800 0 +13}. {973342800 50400 1 +13}. {980596800 46800 0 +13}. {1004792400 50400 1 +13}. {1012046400 46800 0 +13}. {1478350800 50400 1 +13}. {1484398800 46800 0 +13}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.865414495402954
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHqAOsvUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkTAOmy
                                                                                                                                                                                                                          MD5:3282C08FE7BC3A5F4585E97906904AE1
                                                                                                                                                                                                                          SHA1:09497114D1EC149FB5CF167CBB4BE2B5E7FFA982
                                                                                                                                                                                                                          SHA-256:DC6263DCC96F0EB1B6709693B9455CB229C8601A9A0B96A4594A03AF42515633
                                                                                                                                                                                                                          SHA-512:077924E93AC9F610CD9FE158655B631186198BD96995428EB9EE2082449BD36CBF6C214D86E51A6D9A83329FCD5E931C343AA14DBB286C53071D46692B81BC0D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Truk) $TZData(:Pacific/Chuuk).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):144
                                                                                                                                                                                                                          Entropy (8bit):4.9366125478034935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHp8FkXGm2OH4VkxYvXmcDVv0UIvYv:SlSWB9X5PJm2OHYkxYPmyv0a
                                                                                                                                                                                                                          MD5:AD4044C0F87566AA5265DA84CD3DABBA
                                                                                                                                                                                                                          SHA1:15ED1B5960B3E70B23C430B0281B108506BBE76C
                                                                                                                                                                                                                          SHA-256:2C273BA8F8324E1B414B40DC356C78E0FD3C02D5E8158EA5753CA51E1185FC11
                                                                                                                                                                                                                          SHA-512:AD4758B01038BCAA519776226B43D90CED89292BA47988F639D45FD5B5436ED4E3B16C27F9145EC973DCC242FF6ADC514D7CDD6660E7CE8DD8E92A96CDACD947
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wake) {. {-9223372036854775808 39988 0 LMT}. {-2177492788 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):146
                                                                                                                                                                                                                          Entropy (8bit):4.932023172694197
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFx5nUDHpEf/kXGm2OH3UPvXmcCRQH0UIvYv:SlSWB9X5tfTm2OHkPPmiH0a
                                                                                                                                                                                                                          MD5:9FBFA7A7556A081F2352250B44EB0CB6
                                                                                                                                                                                                                          SHA1:CB16A38A9E51FEFC803C4E119395B9BCDBA1CF95
                                                                                                                                                                                                                          SHA-256:29ABBA5D792FB1D754347DED8E17423D12E07231015D5A65A5873BFC0CE474C7
                                                                                                                                                                                                                          SHA-512:CD0FA19597D7188F1D05E8FE9DD9B650DDD30CBBEF3F16646715D5DEF5A261C1E92ADE781DEA609B163808D7A59A0F7AF168332D0134D87DADE42447ABE7E431
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:Pacific/Wallis) {. {-9223372036854775808 44120 0 LMT}. {-2177496920 43200 0 +12}.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):174
                                                                                                                                                                                                                          Entropy (8bit):4.887747451136248
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG9CovedVAIgObT9CknUDHnHPUDH9Cov:SlSWB9IZaM3yckGedVAIgObkkeBy
                                                                                                                                                                                                                          MD5:63594F45385660A04D21C11B5F203FF4
                                                                                                                                                                                                                          SHA1:CEEC55B952B8EBA952E0965D92220C8EF001E59E
                                                                                                                                                                                                                          SHA-256:4418559478B5881DFAF3FE3246A4BFE2E62C46C1D3D452EE4CF5D9651C4F92B5
                                                                                                                                                                                                                          SHA-512:B9B55B027EFB7E87D44E89191C03A8409A16FA19A52032E29210161AE8FED528A6504B7B487181847125AF2C7C129A0687323CDDC6D5454199229897F97F0AB0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Chuuk)]} {. LoadTimeZoneFile Pacific/Chuuk.}.set TZData(:Pacific/Yap) $TZData(:Pacific/Chuuk).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):169
                                                                                                                                                                                                                          Entropy (8bit):4.89278153269951
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVqEGIVyVAIgoqpEGuHtnSi67x/yQa0EGIv:SlSWB9IZaM3ymczVAIgocuN27x6qS
                                                                                                                                                                                                                          MD5:975F22C426CE931547D50A239259609A
                                                                                                                                                                                                                          SHA1:77D68DF6203E3A2C1A2ADD6B6F8E573EF849AE2E
                                                                                                                                                                                                                          SHA-256:309DE0FBCCDAE21114322BD4BE5A8D1375CD95F5FC5A998B3F743E904DC1A131
                                                                                                                                                                                                                          SHA-512:ABDF01FCD0D34B5A8E97C604F3976E199773886E87A13B3CDD2319A92BD34D76533D4BA41978F8AAA134D200B6E87F26CB8C223C2760A4D7A78CD7D889DB79BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Warsaw)]} {. LoadTimeZoneFile Europe/Warsaw.}.set TZData(:Poland) $TZData(:Europe/Warsaw).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):4.887895128079745
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVxMvLSwFVAIgoqyMvLN6nM24h8QavMvLu:SlSWB9IZaM3ymvMv2wFVAIgovMvUe81B
                                                                                                                                                                                                                          MD5:31202B87B7352110A03D740D66DCD967
                                                                                                                                                                                                                          SHA1:439A3700721D4304FA81282E70F6305BB3706C8D
                                                                                                                                                                                                                          SHA-256:8288E9E5FC25549D6240021BFB569ED8EB07FF8610AAA2D39CD45A025EBD2853
                                                                                                                                                                                                                          SHA-512:AB95D3990DC99F6A06BF3384D98D42481E198B2C4D1B2C85E869A2F95B651DDF64406AB15C485698E24F26D1A081E22371CE74809915A7CCA02F2946FB8607BF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Lisbon)]} {. LoadTimeZoneFile Europe/Lisbon.}.set TZData(:Portugal) $TZData(:Europe/Lisbon).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):160
                                                                                                                                                                                                                          Entropy (8bit):4.743612967973961
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8qMvedVAIgNqBolOr4WFKfMv:SlSWB9IZaM3yKMvedVAIgcBoS4wKfMv
                                                                                                                                                                                                                          MD5:A0C5022166493D766E827B88F806CA32
                                                                                                                                                                                                                          SHA1:2A679A391C810122DDD6A7EF722C35328FC09D9C
                                                                                                                                                                                                                          SHA-256:537EA39AFBA7CFC059DE58D484EF450BEE73C7903D36F09A16CA983CB5B8F686
                                                                                                                                                                                                                          SHA-512:85FEF0A89087D2196EC817A6444F9D94A8D315A64EAE9615C615DBB79B30320CED0D49A1A6C2CD566C722971FA8908A675B1C8F7E64D6875505C60400219F938
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Taipei)]} {. LoadTimeZoneFile Asia/Taipei.}.set TZData(:ROC) $TZData(:Asia/Taipei).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):157
                                                                                                                                                                                                                          Entropy (8bit):4.851755466867201
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq8ZQckvFVAIgNtvQstlmFeWFKKQs:SlSWB9IZaM3yJmFVAIgztpwKg
                                                                                                                                                                                                                          MD5:48E7BE02E802A47C0D2F87E633010F38
                                                                                                                                                                                                                          SHA1:A547853A7ED03CE9C07FC3BAA0F57F5ABB4B636B
                                                                                                                                                                                                                          SHA-256:2F362169FD628D6E0CB32507F69AD64177BC812E7E961E5A738F4F492B105128
                                                                                                                                                                                                                          SHA-512:BCBE9BC1C08CFF97B09F8D566EC3B42B9CE8442FA4BECE37A18446CBBF0ECEDA66BA18ABFA5E52E7677B18FB5DABF00DF9E28DE17B094A690B097AFC7130EA89
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Seoul)]} {. LoadTimeZoneFile Asia/Seoul.}.set TZData(:ROK) $TZData(:Asia/Seoul).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.80663340464643
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyq801cwFVAIgNtK1ERLkZ8O5h4WFKf1E:SlSWB9IZaM3yUpFVAIgWWLkth4wKfK
                                                                                                                                                                                                                          MD5:9E2902F20F33CA25B142B6AA51D4D54F
                                                                                                                                                                                                                          SHA1:C1933081F30ABB7780646576D7D0F54DC6F1BC51
                                                                                                                                                                                                                          SHA-256:FCF394D598EC397E1FFEED5282874408D75A9C3FFB260C55EF00F30A80935CA4
                                                                                                                                                                                                                          SHA-512:D56AF44C4E4D5D3E6FC31D56B9BA36BD8499683D1A3C9BC48EEE392C4AC5ACAA10E3E82282F5BDA9586AF26F4B6C0C5649C454399144F040CC94EA35BBB53B48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Asia/Singapore)]} {. LoadTimeZoneFile Asia/Singapore.}.set TZData(:Singapore) $TZData(:Asia/Singapore).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):196
                                                                                                                                                                                                                          Entropy (8bit):4.951561086936219
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSNJB9IZaM3y7p5oedVAIgppKNkjx+90pu:JBaIMYYpgN8+90M
                                                                                                                                                                                                                          MD5:A1D42EC950DE9178058EAA95CCFBAA09
                                                                                                                                                                                                                          SHA1:55BE1FAF85F0D5D5604685F9AC19286142FC7133
                                                                                                                                                                                                                          SHA-256:888A93210241F6639FB9A1DB0519407047CB7F5955F0D5382F2A85C0C473D9A5
                                                                                                                                                                                                                          SHA-512:3C6033D1C84B75871B8E37E71BFEE26549900C555D03F8EC20A31076319E2FEBB0240EC075C2CAFC948D629A32023281166A7C69AFEA3586DEE7A2F585CB5E82
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Puerto_Rico)]} {. LoadTimeZoneFile America/Puerto_Rico.}.set TZData(:SystemV/AST4) $TZData(:America/Puerto_Rico).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.900537547414888
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqx02NEO4FVAIg202NEtYFkRDwh4IAcGE2NEOv:SlSNJB9IZaM3y7UEO4FVAIgpUEqFk+4b
                                                                                                                                                                                                                          MD5:CFDB782F87A616B89203623B9D6E3DBF
                                                                                                                                                                                                                          SHA1:1BB9F75215A172B25D3AE27AAAD6F1D74F837FE6
                                                                                                                                                                                                                          SHA-256:62C72CF0A80A5821663EC5923B3F17C12CE5D6BE1E449874744463BF64BCC3D7
                                                                                                                                                                                                                          SHA-512:085E5B6E81E65BC781B5BC635C6FA1E7BF5DC69295CF739C739F6361BF9EB67F36F7124A2D3E5ADA5F854149C84B9C8A7FB22E5C6E8FF57576EBDEA0E4D6560B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Halifax)]} {. LoadTimeZoneFile America/Halifax.}.set TZData(:SystemV/AST4ADT) $TZData(:America/Halifax).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.911352504536709
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqx0sAzE5YyVAIg20sAzEvYvW6kR/eIAcGEsAzEun:SlSNJB9IZaM3y7hzipVAIgphzGCW6kcQ
                                                                                                                                                                                                                          MD5:01215B5D234C433552A3BF0A440B38F6
                                                                                                                                                                                                                          SHA1:B3A469977D38E1156B81A93D90E638693CFDBEEF
                                                                                                                                                                                                                          SHA-256:2199E7DD20502C4AF25D57A58B11B16BA3173DB47EFA7AD2B33FDB72793C4DDB
                                                                                                                                                                                                                          SHA-512:35D3BDE235FF40C563C7CEDD8A2CCBB4BAC2E2AA24A8E072EA0572BB231295D705EA9F84EEAA9FD2C735B1203332D8D97C3592A2B702BCFE9C81828D4F635205
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Regina)]} {. LoadTimeZoneFile America/Regina.}.set TZData(:SystemV/CST6) $TZData(:America/Regina).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.929669998131187
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqx096dVAIg2096zAtkRwx/h4IAcGE96s:SlSNJB9IZaM3y796dVAIgp96Wkyxp49c
                                                                                                                                                                                                                          MD5:CDE40B5897D89E19A3F2241912B96826
                                                                                                                                                                                                                          SHA1:00DE53DC7AA97F26B1A8BF83315635FBF634ABB3
                                                                                                                                                                                                                          SHA-256:3C83D3DB23862D9CA221109975B414555809C27D45D1ED8B9456919F8BA3BF25
                                                                                                                                                                                                                          SHA-512:69DFC06ACF544B7F95DEF2928C1DFE4D95FAD48EE753AD994921E1967F27A3AF891A9F31DDEA547E1BED81C5D2ECF5FC93E75019F2327DE1E73A009422BE52EC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:SystemV/CST6CDT) $TZData(:America/Chicago).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199
                                                                                                                                                                                                                          Entropy (8bit):4.881715127736134
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSNJB9IZaM3y73G7mFVAIgp3GBLkkp4903G1:JBaIMY3G7Hp3GBLVp4903G1
                                                                                                                                                                                                                          MD5:87FEA19F6D7D08F44F93870F7CBBD456
                                                                                                                                                                                                                          SHA1:EB768ECB0B1B119560D2ACBB10017A8B3DC77FDD
                                                                                                                                                                                                                          SHA-256:2B5887460D6FB393DED5273D1AA87A6A9E1F9E7196A8FA11B4DEB31FAD8922C8
                                                                                                                                                                                                                          SHA-512:00DA47594E80D2DB6F2BE6E482A1140780B71F8BBE966987821249984627C5D8C31AA1F2F6251B4D5084C33C66C007A47AFF4F379FA5DA4A112BA028B982A85A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indianapolis)]} {. LoadTimeZoneFile America/Indianapolis.}.set TZData(:SystemV/EST5) $TZData(:America/Indianapolis).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):190
                                                                                                                                                                                                                          Entropy (8bit):5.071686349792137
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqx0wAy0vwVAIg20wAyatkR5ghxEH/h4IAcGEwAy0v:SlSNJB9IZaM3y71KVAIgp1Bkrp4901h
                                                                                                                                                                                                                          MD5:5C43C828D9460B9DF370F0D155B03A5C
                                                                                                                                                                                                                          SHA1:92F92CD64937703D4829C42FE5656C7CCBA22F4E
                                                                                                                                                                                                                          SHA-256:3F833E2C2E03EF1C3CC9E37B92DBFBA429E73449E288BEBE19302E23EB07C78B
                                                                                                                                                                                                                          SHA-512:A88EAA9DAAD9AC622B75BC6C89EB44A2E4855261A2F7077D8D4018F00FC82E5E1EA364E3D1C08754701A545F5EC74752B9F3657BF589CF76E5A3931F81E99BBF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:SystemV/EST5EDT) $TZData(:America/New_York).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):188
                                                                                                                                                                                                                          Entropy (8bit):4.927529755640769
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNkRSm1hpUDH2fWRn:SlSNJB9IZaM3yc6e8dVAIgOb6ezvNkQN
                                                                                                                                                                                                                          MD5:1A50997B6F22E36D2E1849D1D95D0882
                                                                                                                                                                                                                          SHA1:F4AC3ABBEA4A67013F4DC52A04616152C4C639A9
                                                                                                                                                                                                                          SHA-256:C94C64BF06FDE0A88F24C435A52BDDE0C5C70F383CD09C62D7E42EAB2C54DD2C
                                                                                                                                                                                                                          SHA-512:CCBD66449983844B3DB440442892004D070E5F0DFF454B25C681E13EB2F25F6359D0221CE5FF7800AC794A32D4474FE1126EA2465DB83707FF7496A1B39E6E1A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:SystemV/HST10) $TZData(:Pacific/Honolulu).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.953801751537501
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtkRgFfh4IAcGEutLNn:SlSNJB9IZaM3y7O+FVAIgpObtkch490u
                                                                                                                                                                                                                          MD5:2B415F2251BE08F1035962CE2A04149F
                                                                                                                                                                                                                          SHA1:EFF5CE7CD0A0CBCF366AC531D168CCB2B7C46734
                                                                                                                                                                                                                          SHA-256:569819420F44D127693C6E536CAC77410D751A331268D0C059A1898C0E219CF4
                                                                                                                                                                                                                          SHA-512:971F1763558D8AC17753C01B7BB64E947C448AA29951064ED7C5997D4B4A652C7F5D7C2CB4F8040F73AD83D7E49B491B93047A06D8C699F33B08F4A064BE0DCC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:SystemV/MST7) $TZData(:America/Phoenix).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.909831110037175
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqx06RGFwVAIg206RAO0LkRMMFfh4IAcGE6Ru:SlSNJB9IZaM3y7+SwVAIgp+iLkD490+u
                                                                                                                                                                                                                          MD5:895E9BAF5EDF0928D4962C3E6650D843
                                                                                                                                                                                                                          SHA1:52513BFA267CA2E84FDDF3C252A4E8FD059F2847
                                                                                                                                                                                                                          SHA-256:465A4DE93F2B103981A54827CDEBB10350A385515BB8648D493FD376AABD40AF
                                                                                                                                                                                                                          SHA-512:CAF19320F0F507160E024C37E26987A99F2276622F2A6D8D1B7E3068E5459960840F4202FF8A98738B9BCA0F42451304FC136CBD36BBFE39F616622217AD89A3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:SystemV/MST7MDT) $TZData(:America/Denver).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):187
                                                                                                                                                                                                                          Entropy (8bit):4.782387645904801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqTQGuQTWLM4YkvFVAIgObTuQTWLvqtkRQB5nUDHuQTWi:SlSNJB9IZaM3yciQyLM4YmFVAIgObiQq
                                                                                                                                                                                                                          MD5:67AE3FD76B2202F3B1CF0BBC664DE8D0
                                                                                                                                                                                                                          SHA1:4603DE0753B684A8D7ACB78A6164D5686542EE8E
                                                                                                                                                                                                                          SHA-256:30B3FC95A7CB0A6AC586BADF47E9EFA4498995C58B80A03DA2F1F3E8A2F3553B
                                                                                                                                                                                                                          SHA-512:BF45D0CA674DD631D3E8442DFB333812B5B31DE61576B8BE33B94E0433936BC1CD568D9FC522C84551E770660BE2A98F45FE3DB4B6577968DF57071795B53AD9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pitcairn)]} {. LoadTimeZoneFile Pacific/Pitcairn.}.set TZData(:SystemV/PST8) $TZData(:Pacific/Pitcairn).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):199
                                                                                                                                                                                                                          Entropy (8bit):4.959254419324467
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSNJB9IZaM3y7DvwFVAIgpdJLkQ1p490Dvn:JBaIMYFpdJLh090z
                                                                                                                                                                                                                          MD5:DFB48E0E2CE5D55DC60B3E95B7D12813
                                                                                                                                                                                                                          SHA1:535E0BF050E41DCFCE08686AFDFAFF9AAFEF220C
                                                                                                                                                                                                                          SHA-256:74096A41C38F6E0641934C84563277EBA33C5159C7C564C7FF316D050083DD6D
                                                                                                                                                                                                                          SHA-512:3ECDF3950ED3FB3123D6C1389A2A877842B90F677873A0C106C4CA6B180EEC38A26C74E21E8A3036DA8980FF7CA9E1578B0E1D1A3EA364A4175772F468747425
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:SystemV/PST8PDT) $TZData(:America/Los_Angeles).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.905971098884841
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFLLJJT8QFCZaMuUyqTQG5hB5pVAIgObT5hBiLkRKlUDH5hBun:SlSNJB9IZaM3ycTpVAIgOb4LkK
                                                                                                                                                                                                                          MD5:CED0A343EF3A316902A10467B2F66B9B
                                                                                                                                                                                                                          SHA1:5884E6BA28FD71A944CA2ED9CB118B9E108EF7CB
                                                                                                                                                                                                                          SHA-256:1BB5A98B80989539135EAB3885BBA20B1E113C19CB664FB2DA6B150DD1F44F68
                                                                                                                                                                                                                          SHA-512:903D1DC6D1E192D4A98B84247037AE171804D250BB5CB84D2C5E145A0BDC50FCD543B70BAFF8440AFF59DA14084C8CEEFB2F912A02B36B7571B0EEEC154983B3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Gambier)]} {. LoadTimeZoneFile Pacific/Gambier.}.set TZData(:SystemV/YST9) $TZData(:Pacific/Gambier).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):193
                                                                                                                                                                                                                          Entropy (8bit):4.949109665596263
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSNJB9IZaM3y7/9EtDvFVAIgp/9EmLkB490/9E6:JBaIMY/944p/9xLN90/9F
                                                                                                                                                                                                                          MD5:D588930E34CF0A03EFEE7BFBC5022BC3
                                                                                                                                                                                                                          SHA1:0714C6ECAAF7B4D23272443E5E401CE141735E78
                                                                                                                                                                                                                          SHA-256:4D1CAE3C453090667549AB83A8DE6F9B654AAC5F540192886E5756A01D21A253
                                                                                                                                                                                                                          SHA-512:ABE69BEF808D7B0BEF9F49804D4A753E033D7C99A7EA57745FE4C3CBE2C26114A8845A219ED6DEAB8FA009FDB86E384687068C1BCF8B704CCF24DA7029455802
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by ../tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:SystemV/YST9YDT) $TZData(:America/Anchorage).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):175
                                                                                                                                                                                                                          Entropy (8bit):4.882090609090058
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxV0XaDvFVAIgoq3XPHtjCl1yQaqXNn:SlSWB9IZaM3ymQazFVAIgoQPHtSymN
                                                                                                                                                                                                                          MD5:41703ED241199F0588E1FC6FF0F33E90
                                                                                                                                                                                                                          SHA1:08B4785E21E21DFE333766A7198C325CD062347B
                                                                                                                                                                                                                          SHA-256:4B8A8CE69EE94D7E1D49A2E00E2944675B66BD16302FE90E9020845767B0509B
                                                                                                                                                                                                                          SHA-512:F90F6B0002274AF57B2749262E1530E21906162E4D1F3BE89639B5449269F3026A7F710C24765E913BC23DEC5A6BF97FC0DD465972892D851B6EAEEF025846CA
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Istanbul)]} {. LoadTimeZoneFile Europe/Istanbul.}.set TZData(:Turkey) $TZData(:Europe/Istanbul).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):4.792993822845485
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqAmMwFVAIghO6iGMFfh8RS:SlSWB9IZaM3y1wFVAIghFiP8RS
                                                                                                                                                                                                                          MD5:1921CC58408AD2D7ED3B5308C71B1A28
                                                                                                                                                                                                                          SHA1:12F832D7B3682DC28A49481B8FBA8C55DCDC60D0
                                                                                                                                                                                                                          SHA-256:92FC6E3AA418F94C486CE5BF6861FAA4E85047189E98B90DA78D814810E88CE7
                                                                                                                                                                                                                          SHA-512:EB134E2E7F7A811BFA8223EB4E98A94905EA24891FD95AB29B52DE2F683C97E086AA2F7B2EA93FBA2451AAEDD22F01219D700812DABC7D6670028ACF9AAB8367
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UCT)]} {. LoadTimeZoneFile Etc/UCT.}.set TZData(:UCT) $TZData(:Etc/UCT).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):184
                                                                                                                                                                                                                          Entropy (8bit):4.864166947846424
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0/VXEtDvFVAIg20/VXE0JLiOGl0IAcGE/VXE6n:SlSWB9IZaM3y7/9EtDvFVAIgp/9EmLiB
                                                                                                                                                                                                                          MD5:0763082FF8721616592350D8372D59FF
                                                                                                                                                                                                                          SHA1:CEBB03EB7F44530CF52DCA7D55DC912015604D94
                                                                                                                                                                                                                          SHA-256:94FDFE2901596FC5DCE74A5560431F3E777AE1EBEEE59712393AE2323F17ADFA
                                                                                                                                                                                                                          SHA-512:DFE8AAA009C28C209A925BBE5509589C0087F6CC78F94763BFA9F1F311427E3FF2E377EB340590383D790D3578C1BB37D41525408D027763EA96ECB3A3AAD65D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Anchorage)]} {. LoadTimeZoneFile America/Anchorage.}.set TZData(:US/Alaska) $TZData(:America/Anchorage).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):171
                                                                                                                                                                                                                          Entropy (8bit):4.839824852896375
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0/yO5pVAIg20/yOvYvtiObMEIB/4IAcGE/yOun:SlSWB9IZaM3y7/ykVAIgp/y9FitE8/47
                                                                                                                                                                                                                          MD5:01142938A2E5F30FADE20294C829C116
                                                                                                                                                                                                                          SHA1:8F9317E0D3836AF916ED5530176C2BF7A929C3C7
                                                                                                                                                                                                                          SHA-256:1DD79263FB253217C36A9E7DDCB2B3F35F208E2CE812DCDE5FD924593472E4FE
                                                                                                                                                                                                                          SHA-512:2C47FE8E8ED0833F4724EF353A9A6DFCE3B6614DA744E64364E9AB423EC92565FEF1E8940CB12A0BCCFE0BD6B44583AF230A4ABCC0BAE3D9DC43FBB2C7941CFF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Adak)]} {. LoadTimeZoneFile America/Adak.}.set TZData(:US/Aleutian) $TZData(:America/Adak).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.886225611026426
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0utLaDvFVAIg20utLPtiQMfQfBx+IAcGEutLNn:SlSWB9IZaM3y7O+FVAIgpObtiZfQfH+v
                                                                                                                                                                                                                          MD5:090DC30F7914D5A5B0033586F3158384
                                                                                                                                                                                                                          SHA1:2F526A63A1C47F88E320BE1C12CA8887DA2DC989
                                                                                                                                                                                                                          SHA-256:47D25266ABBD752D61903C903ED3E9CB485A7C01BD2AA354C5B50DEBC253E01A
                                                                                                                                                                                                                          SHA-512:5FE75328595B5DECDAC8D318BEE89EAD744A881898A4B45DD2ABB5344B13D8AFB180E4A8F8D098A9589488D9379B0153CBC5CF638AF7011DE89C57B554F42757
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Phoenix)]} {. LoadTimeZoneFile America/Phoenix.}.set TZData(:US/Arizona) $TZData(:America/Phoenix).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):179
                                                                                                                                                                                                                          Entropy (8bit):4.854450230853601
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx096dVAIg2096zAtibXgox/h4IAcGE96s:SlSWB9IZaM3y796dVAIgp96WiB49096s
                                                                                                                                                                                                                          MD5:E0801B5A57F40D42E8AF6D48C2A41467
                                                                                                                                                                                                                          SHA1:A49456A1BF1B73C6B284E0764AEAFD1464E70DDC
                                                                                                                                                                                                                          SHA-256:16C7FFCE60495E5B0CB65D6D5A0C3C5AA9E62BD6BC067ABD3CD0F691DA41C952
                                                                                                                                                                                                                          SHA-512:3DE6A41B88D6485FD1DED2DB9AB9DAD87B9F9F95AA929D38BF6498FC0FD76A1048CE1B68F24CD22C487073F59BD955AFCB9B7BF3B20090F81FA250A5E7674A53
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Chicago)]} {. LoadTimeZoneFile America/Chicago.}.set TZData(:US/Central) $TZData(:America/Chicago).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):223
                                                                                                                                                                                                                          Entropy (8bit):4.715837665658945
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y73GK7mFVAIgp3GKBLi3E0903GK1:MBaIMY3GK7Hp3GKBLi3t903GK1
                                                                                                                                                                                                                          MD5:1A27644D1BF2299B7CDDED7F405D6570
                                                                                                                                                                                                                          SHA1:BD03290A6E7A967152E2E4F95A82E01E7C35F63C
                                                                                                                                                                                                                          SHA-256:1C46FAEDFACEB862B2E4D5BD6AC63E5182E1E2CFD2E1CDFA2661D698CC8B0072
                                                                                                                                                                                                                          SHA-512:9D6F3E945656DD97A7E956886C1123B298A87704D4F5671E4D1E94531C01F8BE377D83239D8BE78E2B3E1C0C20E5779BA3978F817A6982FE607A18A7FDCF57FB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Indianapolis)]} {. LoadTimeZoneFile America/Indiana/Indianapolis.}.set TZData(:US/East-Indiana) $TZData(:America/Indiana/Indianapolis).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):182
                                                                                                                                                                                                                          Entropy (8bit):4.990255962392122
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0wAy0vwVAIg20wAyati37oxp4IAcGEwAy0v:SlSWB9IZaM3y71KVAIgp1Bi37oxp490n
                                                                                                                                                                                                                          MD5:3FE03D768F8E535506D92A6BC3C03FD2
                                                                                                                                                                                                                          SHA1:F82BF149CE203B5A4A1E106A495D3409AF7A07AC
                                                                                                                                                                                                                          SHA-256:9F46C0E46F6FE26719E2CF1FA05C7646530B65FB17D4101258D357568C489D77
                                                                                                                                                                                                                          SHA-512:ADFDBB270113A192B2378CC347DD8A57FDBDC776B06F9E16033EE8D5EAB49E16234CA2523580EEBB4DCDD27F33222EDD5514F0D7D85723597F059C5D6131E1B0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/New_York)]} {. LoadTimeZoneFile America/New_York.}.set TZData(:US/Eastern) $TZData(:America/New_York).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):181
                                                                                                                                                                                                                          Entropy (8bit):4.832149382727646
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQG2fWGYFedVAIgObT2fWzvNioMN75nUDH2fWRn:SlSWB9IZaM3yc6e8dVAIgOb6ezvNioEe
                                                                                                                                                                                                                          MD5:347E51049A05224D18F264D08F360CBB
                                                                                                                                                                                                                          SHA1:A801725A9B01B5E08C63BD2568C8F5D084F0EB02
                                                                                                                                                                                                                          SHA-256:EA5D18E4A7505406D6027AD34395297BCF5E3290283C7CC28B4A34DB8AFBDD97
                                                                                                                                                                                                                          SHA-512:C9B96C005D90DD8F317A697F59393D20663DE74D6E4D0B45BCE109B31A328D7AA62C51FAA8D00C728C0342940EF3B0F0921814B31BD7FE128A6E95F92CF50E06
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Honolulu)]} {. LoadTimeZoneFile Pacific/Honolulu.}.set TZData(:US/Hawaii) $TZData(:Pacific/Honolulu).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):201
                                                                                                                                                                                                                          Entropy (8bit):4.825742972037525
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y73GKXFVAIgp3GK4NiGIfh4903GKk:MBaIMY3GKXQp3GKeiBfh4903GKk
                                                                                                                                                                                                                          MD5:E111813F4C9B888427B8363949C87C72
                                                                                                                                                                                                                          SHA1:96B6692DCD932DCC856804BE0C2145538C4B2B33
                                                                                                                                                                                                                          SHA-256:4E896634F3A400786BBD996D1FE0D5C9A346E337027B240F1671A7E4B38C8F69
                                                                                                                                                                                                                          SHA-512:97726D7EDB7D7A1F6E815A0B875CAF9E2D2D27F50ECC866FBC6CB1B88836E8C2D64A9C108CD917C9D641B30822397664A2AC8010EADF0FF2A6C205AE4D5E7A2F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Indiana/Knox)]} {. LoadTimeZoneFile America/Indiana/Knox.}.set TZData(:US/Indiana-Starke) $TZData(:America/Indiana/Knox).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):180
                                                                                                                                                                                                                          Entropy (8bit):4.7846496799669405
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx06FQGFwVAIg206FQN6iHaMCELMr4IAcGE6FQu:SlSWB9IZaM3y74PFwVAIgp4xiHaMHL+U
                                                                                                                                                                                                                          MD5:80A9A00EC1C5904A67DC3E8B2FDC3150
                                                                                                                                                                                                                          SHA1:8E79FBEB49D9620E793E4976D0B9085E32C57E83
                                                                                                                                                                                                                          SHA-256:8DB76FC871DD334DA87297660B145F8692AD053B352A19C2EFCD74AF923D762D
                                                                                                                                                                                                                          SHA-512:0A5662E33C60030265ECAD1FF683B18F6B99543CA5FE22F88BCE597702FBEA20358BCB9A568D7F8B32158D9E6A3D294081D183644AD49C22AC3512F97BE480D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Detroit)]} {. LoadTimeZoneFile America/Detroit.}.set TZData(:US/Michigan) $TZData(:America/Detroit).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):177
                                                                                                                                                                                                                          Entropy (8bit):4.84430947557215
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx06RGFwVAIg206RAO0LiBOlLo/4IAcGE6Ru:SlSWB9IZaM3y7+SwVAIgp+iLiBY8/49G
                                                                                                                                                                                                                          MD5:13D6C7CF459995691E37741ACAF0A18D
                                                                                                                                                                                                                          SHA1:A0626763930C282DF21ED3AA8F1B35033BA2F9DC
                                                                                                                                                                                                                          SHA-256:223B5C8E34F459D7B221B83C45DBB2827ABE376653BAA1BC56D09D50DF136B08
                                                                                                                                                                                                                          SHA-512:9076DFECC5D02DB38ECE3D2512D52566675D98A857711676E891D8741EA588153954357FE19F4C69305FF05D0F99286F1D496DF0C7FDBC8D59803D1B1CFA5F07
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Denver)]} {. LoadTimeZoneFile America/Denver.}.set TZData(:US/Mountain) $TZData(:America/Denver).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):191
                                                                                                                                                                                                                          Entropy (8bit):4.885594237758327
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqx0ydJg4owFVAIg20ydJEvRLiP+e2IAcGEydJgvn:SlSWB9IZaM3y7DvwFVAIgpdJLip290Dv
                                                                                                                                                                                                                          MD5:EBF51CD015BD387FA2BB30DE8806BDDA
                                                                                                                                                                                                                          SHA1:63C2E2F4CD8BC719A06D59EF4CE4C31F17F53EA0
                                                                                                                                                                                                                          SHA-256:B7AD78FB955E267C0D75B5F7279071EE17B6DD2842DAD61ADA0165129ADE6A86
                                                                                                                                                                                                                          SHA-512:22BECE2AEAD66D921F38B04FDC5A41F2627FCC532A171EA1C9C9457C22CD79EFD1EC3C7CC62BC016751208AD1D064B0F03C2185F096982F73740D8426495F5ED
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific) $TZData(:America/Los_Angeles).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):195
                                                                                                                                                                                                                          Entropy (8bit):4.931883193402467
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:SlSWB9IZaM3y7DvwFVAIgpdJLi0Q90Dvn:MBaIMYFpdJLix90z
                                                                                                                                                                                                                          MD5:01CD3EBFDB7715805572CDA3F81AC78A
                                                                                                                                                                                                                          SHA1:C013C38D2FB9E649EE43FED6910382150C2B3DF5
                                                                                                                                                                                                                          SHA-256:DEFE67C520303EF85B381EBEAED4511C0ACF8C49922519023C525E6A1B09B9DD
                                                                                                                                                                                                                          SHA-512:266F35C34001CD4FF00F51F5CDF05E1F4D0B037F276EFD2D124C8AE3391D00128416D16D886B3ECDF9E9EFC81C66B2FD4ED55F154437ED5AA32876B855289190
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(America/Los_Angeles)]} {. LoadTimeZoneFile America/Los_Angeles.}.set TZData(:US/Pacific-New) $TZData(:America/Los_Angeles).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):183
                                                                                                                                                                                                                          Entropy (8bit):4.789322986138067
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqTQGurKeTIVAIgObTurKeUAti6A5nUDHurKeTv:SlSWB9IZaM3ycieZVAIgObieiidXeg
                                                                                                                                                                                                                          MD5:E883D478518F6DAF8173361A8D308D34
                                                                                                                                                                                                                          SHA1:ABD97858655B0069BFD5E11DD95BF6D7C2109AEA
                                                                                                                                                                                                                          SHA-256:DD4B1812A309F90ABBD001C3C73CC2AF1D4116128787DE961453CCBE53EC9B6A
                                                                                                                                                                                                                          SHA-512:DA1FE6D92424404111CBB18CA39C8E29FA1F9D2FD262D46231FB7A1A78D79D00F92F5D1DEBB9B92565D1E3BA03EF20D2A44B76BA0FC8B257A601EED5976386CC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Pacific/Pago_Pago)]} {. LoadTimeZoneFile Pacific/Pago_Pago.}.set TZData(:US/Samoa) $TZData(:Pacific/Pago_Pago).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):148
                                                                                                                                                                                                                          Entropy (8bit):4.792993822845485
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiLB5h8RFu:SlSWB9IZaM3yzUFVAIgBLiLfh8RI
                                                                                                                                                                                                                          MD5:530F5381F9CD8542ED5690E47FC83358
                                                                                                                                                                                                                          SHA1:29A065F004F23A5E3606C2DB50DC0AB28CAFC785
                                                                                                                                                                                                                          SHA-256:AC0FF734DA267E5F20AB573DBD8C0BD7613B84D86FDA3C0809832F848E142BC8
                                                                                                                                                                                                                          SHA-512:4328BDFD6AA935FD539EE2D4A3EBA8DD2A1BD9F44BA0CF30AA0C4EA57B0A58E3CDFAA312366A0F93766AE445E6E210EE57CD5ED60F74173EDF67C1C5CB987C68
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:UTC) $TZData(:Etc/UTC).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):154
                                                                                                                                                                                                                          Entropy (8bit):4.829496870339919
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLiL7DJMFfh8RFu:SlSWB9IZaM3yzUFVAIgBLiL7VMr8RI
                                                                                                                                                                                                                          MD5:60878BB8E8BE290911CAB2A16AAFAEF7
                                                                                                                                                                                                                          SHA1:15C01523EDA134D3E38ECC0A5909A4579BD2A00D
                                                                                                                                                                                                                          SHA-256:9324B6C871AC55771C44B82BF4A92AE0BE3B2CC64EBA9FE878571225FD38F818
                                                                                                                                                                                                                          SHA-512:C697401F1C979F5A4D33E1026DCE5C77603E56A48405511A09D8CE178F1BF47D60F217E7897061F71CFEA63CC041E64340EF6BAEE0EB037AFD34C71BF0591E3E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Universal) $TZData(:Etc/UTC).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):167
                                                                                                                                                                                                                          Entropy (8bit):4.9534620854837295
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqxVwTwpVAIgoqzTcYFgIuyQauTnn:SlSWB9IZaM3ymdVAIgohYFgXymn
                                                                                                                                                                                                                          MD5:58FBF79D86DBCFF53F74BF7FE5C12DD6
                                                                                                                                                                                                                          SHA1:EA8B3317B012A661B3BA4A1FAE0DC5DEDC03BC26
                                                                                                                                                                                                                          SHA-256:0DECFEACCE2E2D88C29CB696E7974F89A687084B3DB9564CDED6FC97BCD74E1F
                                                                                                                                                                                                                          SHA-512:083B449DE987A634F7199666F9C685EADD643C2C2DD9C8F6C188388266729CE0179F9DC0CD432D713E5FB1649D0AA1A066FE616FC43DA65C4CD787D8E0DE00A6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Europe/Moscow)]} {. LoadTimeZoneFile Europe/Moscow.}.set TZData(:W-SU) $TZData(:Europe/Moscow).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6694
                                                                                                                                                                                                                          Entropy (8bit):3.6896780927557495
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:D6U5vo30NSfAewvtj544IrvfMS4pBs6nLUxZlJFXmA3SG7iL8malvkUEYo4Q:5PIMj544IrvfMsbxZTH7qwQ
                                                                                                                                                                                                                          MD5:CD86A6ED164FEB33535D74DF52DC49A5
                                                                                                                                                                                                                          SHA1:89843BF23AB113847DCC576990A4FF2CABCA03FE
                                                                                                                                                                                                                          SHA-256:AF28754C77BA41712E9C49EF3C9E08F7D43812E3317AD4E2192E971AD2C9B02D
                                                                                                                                                                                                                          SHA-512:80C0A7C3BDD458CA4C1505B2144A3AD969F7B2F2732CCBE4E773FBB6ED446C2961E0B5AFFBC124D43CE9AB530C42C8AEC7100E7817566629CE9D01AC057E3549
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit..set TZData(:WET) {. {-9223372036854775808 0 0 WET}. {228877200 3600 1 WEST}. {243997200 0 0 WET}. {260326800 3600 1 WEST}. {276051600 0 0 WET}. {291776400 3600 1 WEST}. {307501200 0 0 WET}. {323830800 3600 1 WEST}. {338950800 0 0 WET}. {354675600 3600 1 WEST}. {370400400 0 0 WET}. {386125200 3600 1 WEST}. {401850000 0 0 WET}. {417574800 3600 1 WEST}. {433299600 0 0 WET}. {449024400 3600 1 WEST}. {465354000 0 0 WET}. {481078800 3600 1 WEST}. {496803600 0 0 WET}. {512528400 3600 1 WEST}. {528253200 0 0 WET}. {543978000 3600 1 WEST}. {559702800 0 0 WET}. {575427600 3600 1 WEST}. {591152400 0 0 WET}. {606877200 3600 1 WEST}. {622602000 0 0 WET}. {638326800 3600 1 WEST}. {654656400 0 0 WET}. {670381200 3600 1 WEST}. {686106000 0 0 WET}. {701830800 3600 1 WEST}. {717555600 0 0 WET}. {733280400 3600 1 WEST}. {749005200 0 0 WET}. {764730000 36
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):149
                                                                                                                                                                                                                          Entropy (8bit):4.830292555237936
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:SlEVFRKvJT8QFCZaMuUyqAxmSwFVAIgESRLtaFBURFu:SlSWB9IZaM3yzUFVAIgBLYFaRI
                                                                                                                                                                                                                          MD5:6C7C2CE174DB462A3E66D9A8B67A28EB
                                                                                                                                                                                                                          SHA1:73B74BEBCDAEBDA4F46748BCA149BC4C7FE82722
                                                                                                                                                                                                                          SHA-256:4472453E5346AAA1E1D4E22B87FDC5F3170AA013F894546087D0DC96D4B6EC43
                                                                                                                                                                                                                          SHA-512:07209059E5E5EB5EE12821C1AC46922DA2715EB7D7196A478F0FA6866594D3C69F4C50006B0EE517CBF6DB07164915F976398EBBD88717A070D750D5D106BA5D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# created by tools/tclZIC.tcl - do not edit.if {![info exists TZData(Etc/UTC)]} {. LoadTimeZoneFile Etc/UTC.}.set TZData(:Zulu) $TZData(:Etc/UTC).
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4860
                                                                                                                                                                                                                          Entropy (8bit):4.7851008522116585
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:Le+U54W37GWdh85qWdhAjgr9a+1FeS9D/CkXg6gvF9D/CYjX16AyyrGuA11/JRJZ:q+W/7GW85qW9a+P39DCd6gt9DC+6AjGN
                                                                                                                                                                                                                          MD5:C5DA264DC0CE5669F81702170B2CDC59
                                                                                                                                                                                                                          SHA1:FED571B893EE2DC93DAF8907195503885FFACBB6
                                                                                                                                                                                                                          SHA-256:A5311E3640E42F7EFF5CC1A0D8AD6956F738F093B037155674D46B634542FE5F
                                                                                                                                                                                                                          SHA-512:1F1993F1F19455F87EC9952BF7CEA00A5082BD2F2E1A417FBC4F239835F3CED6C8D5E09CDA6D1A4CD9F8A24AF174F9AB1DC7BD5E94C7A6DEE2DD9F8FE7F690FF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# word.tcl --.#.# This file defines various procedures for computing word boundaries in.# strings. This file is primarily needed so Tk text and entry widgets behave.# properly for different platforms..#.# Copyright (c) 1996 by Sun Microsystems, Inc..# Copyright (c) 1998 by Scritpics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# The following variables are used to determine which characters are.# interpreted as white space...if {$::tcl_platform(platform) eq "windows"} {. # Windows style - any but a unicode space char. if {![info exists ::tcl_wordchars]} {..set ::tcl_wordchars {\S}. }. if {![info exists ::tcl_nonwordchars]} {..set ::tcl_nonwordchars {\s}. }.} else {. # Motif style - any unicode word char (number, letter, or underscore). if {![info exists ::tcl_wordchars]} {..set ::tcl_wordchars {\w}. }. if {![info exists ::tcl_nonwordchars]} {..set ::tcl_nonwo
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1468064
                                                                                                                                                                                                                          Entropy (8bit):6.165850680457804
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24576:J7+Vm6O8hbcrckTNrkhaJVQhWnmb7u/DSe9qT03ZjLmFMoERDY5TUT/tXzddGyIK:JCQ69cYY9JVQWx/DSe9qTqJLUMPsJUT/
                                                                                                                                                                                                                          MD5:FDC8A5D96F9576BD70AA1CADC2F21748
                                                                                                                                                                                                                          SHA1:BAE145525A18CE7E5BC69C5F43C6044DE7B6E004
                                                                                                                                                                                                                          SHA-256:1A6D0871BE2FA7153DE22BE008A20A5257B721657E6D4B24DA8B1F940345D0D5
                                                                                                                                                                                                                          SHA-512:816ADA61C1FD941D10E6BB4350BAA77F520E2476058249B269802BE826BAB294A9C18EDC5D590F5ED6F8DAFED502AB7FFB29DB2F44292CB5BEDF2F5FA609F49C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................B................R..................Rich..................PE..d......\.........." .........J......@........................................p.......f....`.............................................@@..P>..|........{......,....L.......0...?..`................................................ ..P............................text...c........................... ..`.rdata...?... ...@..................@..@.data........`.......N..............@....pdata..,...........................@..@.rsrc....{.......|..................@..@.reloc...?...0...@..................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8246
                                                                                                                                                                                                                          Entropy (8bit):4.8180558683809425
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:tKrjbDL5//nNFn0rBnDQQ2d4YGpFAImoYyMxZ34wNsf9GnEF5SpcJV+H//iNx:tIjL5//zC/8HLx4XKKv
                                                                                                                                                                                                                          MD5:11D758CEF126C5C2EDFC911237DF80F2
                                                                                                                                                                                                                          SHA1:7911EAA0A8B6630D016D15730310935909632389
                                                                                                                                                                                                                          SHA-256:DA84D32D1B447F7FFE7BBCAC0F7586B0B6DD204717C7AE1F182C6A91510EC77B
                                                                                                                                                                                                                          SHA-512:9E2A767FBC62622C34F468958C861EE3AFE2A63005BAD80F1637045D045E1A82FB1D2698D948D375222EBD0B92514ACE99C12DF6D9CACF75ACD03EC8057494A7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# bgerror.tcl --.#.#.Implementation of the bgerror procedure. It posts a dialog box with.#.the error message and gives the user a chance to see a more detailed.#.stack trace, and possible do something more interesting with that.#.trace (like save it to a log). This is adapted from work done by.#.Donal K. Fellows..#.# Copyright (c) 1998-2000 by Ajuba Solutions..# Copyright (c) 2007 by ActiveState Software Inc..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>..namespace eval ::tk::dialog::error {. namespace import -force ::tk::msgcat::*. namespace export bgerror. option add *ErrorDialog.function.text [mc "Save To Log"] \..widgetDefault. option add *ErrorDialog.function.command [namespace code SaveToLog]. option add *ErrorDialog*Label.font TkCaptionFont widgetDefault. if {[tk windowingsystem] eq "aqua"} {..option add *ErrorDialog*background systemAlertBackgroundActive \...widgetDefault.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20642
                                                                                                                                                                                                                          Entropy (8bit):4.903366631227966
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:8zVtoY3wFnq+j4SpEdPmVmZ6/IVKuzmSaox2ESo+VtocUP5wFnq+j4SpEdPmV8ZQ:coahPSFMmfoz4oFXhPovzmToQBy0zm2m
                                                                                                                                                                                                                          MD5:309AB5B70F664648774453BCCBE5D3CE
                                                                                                                                                                                                                          SHA1:51BF685DEDD21DE3786FE97BC674AB85F34BD061
                                                                                                                                                                                                                          SHA-256:0D95949CFACF0DF135A851F7330ACC9480B965DAC7361151AC67A6C667C6276D
                                                                                                                                                                                                                          SHA-512:D5139752BD7175747A5C912761916EFB63B3C193DD133AD25D020A28883A1DEA6B04310B751F5FCBE579F392A8F5F18AE556116283B3E137B4EA11A2C536EC6B
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# button.tcl --.#.# This file defines the default bindings for Tk label, button,.# checkbutton, and radiobutton widgets and provides procedures.# that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 2002 ActiveState Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for buttons..#-------------------------------------------------------------------------..if {[tk windowingsystem] eq "aqua"} {.. bind Radiobutton <Enter> {..tk::ButtonEnter %W. }. bind Radiobutton <1> {..tk::ButtonDown %W. }. bind Radiobutton <ButtonRelease-1> {..tk::ButtonUp %W. }. bind Checkbutton <Enter> {..tk::ButtonEnter %W. }. bind Checkbutton <1
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Nim source code, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9652
                                                                                                                                                                                                                          Entropy (8bit):4.750454352074374
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:MvjK3vpIKU7JBhpZofNAieYemp8U3wNV97oZQWpopePXUsyWjocIegf6tq9jJKT4:M4viKeBQ+3M3wNwvwsFyoIegf6wO70fN
                                                                                                                                                                                                                          MD5:E703C16058E7F783E9BB4357F81B564D
                                                                                                                                                                                                                          SHA1:1EDA07870078FC4C3690B54BB5330A722C75AA05
                                                                                                                                                                                                                          SHA-256:30CE631CB1CCCD20570018162C6FFEF31BAD378EF5B2DE2D982C96E65EB62EF6
                                                                                                                                                                                                                          SHA-512:28617F8553766CA7A66F438624AFA5FD7780F93DC9EBDF9BEE865B5649228AA56A69189218FC436CEDF2E5FE3162AD88839CBF49C9CC051238A7559B5C3BA726
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# choosedir.tcl --.#.#.Choose directory dialog implementation for Unix/Mac..#.# Copyright (c) 1998-2000 by Scriptics Corporation..# All rights reserved...# Make sure the tk::dialog namespace, in which all dialogs should live, exists.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}..# Make the chooseDir namespace inside the dialog namespace.namespace eval ::tk::dialog::file::chooseDir {. namespace import -force ::tk::msgcat::*.}..# ::tk::dialog::file::chooseDir:: --.#.#.Implements the TK directory selection dialog..#.# Arguments:.#.args..Options parsed by the procedure..#.proc ::tk::dialog::file::chooseDir:: {args} {. variable ::tk::Priv. set dataName __tk_choosedir. upvar ::tk::dialog::file::$dataName data. Config $dataName $args.. if {$data(-parent) eq "."} {. set w .$dataName. } else {. set w $data(-parent).$dataName. }.. # (re)create the dialog box if necessary. #. if {![winfo exists $w]} {..::tk::dialog::file::Create
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):21432
                                                                                                                                                                                                                          Entropy (8bit):4.987740767386718
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:HDJsgeqJelEu6i1T26UYdTVDyPHxQlufbSIjVjrdOqAQBxhKN2zD5Ed9bmqU/FC6:jagJJnBfxQef9
                                                                                                                                                                                                                          MD5:E5E462E0EE0C57B31DAEECB07D038488
                                                                                                                                                                                                                          SHA1:E67B3410A7BCECE8B5159AB5327910038096A67B
                                                                                                                                                                                                                          SHA-256:823F6E4BAF5D10185D990B3FBCB8BFB4D5F4B6ED62203EE229922B6B32FE39D4
                                                                                                                                                                                                                          SHA-512:F8442F21E389FF9A3FC5BECCE8811F8554DEF94FBB8F184026396A87AEA37E8108A3E1B3C76FEA2CFBE4E81B2C5FC2BB8A60BE2B9831CC96CB25DAB177616238
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# clrpick.tcl --.#.#.Color selection dialog for platforms that do not support a.#.standard color selection dialog..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# ToDo:.#.#.(1): Find out how many free colors are left in the colormap and.#. don't allocate too many colors..#.(2): Implement HSV color selection..#..# Make sure namespaces exist.namespace eval ::tk {}.namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::color {. namespace import ::tk::msgcat::*.}..# ::tk::dialog::color:: --.#.#.Create a color dialog and let the user choose a color. This function.#.should not be called directly. It is called by the tk_chooseColor.#.function when a native color selector widget does not exist.#.proc ::tk::dialog::color:: {args} {. variable ::tk::Priv. set dataName __tk__color. upvar ::tk::dialog::color::$dataName data. set w .$dataName.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8229
                                                                                                                                                                                                                          Entropy (8bit):5.0540566175865
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:Aq7cPy5HEOjKU8QHyWpSWNRYs50asAZ5QWlO+W0WvHv/3WvWHwV7vWKpTTk:Aq7c6HJjKCyWpZNRYEVVET1rvveuHSOT
                                                                                                                                                                                                                          MD5:427CCBD25BB1559B9B21A80131658140
                                                                                                                                                                                                                          SHA1:B675C0C1B02A527B13AA5DE2AE5A1AA754E9815D
                                                                                                                                                                                                                          SHA-256:586CB7A3C32566EFEB46036A19D07E91194CE8EDAF0D47F3C93BCC974E6EE3E1
                                                                                                                                                                                                                          SHA-512:FEA82D6D7DBAF52EE1883241170BA95396EC282CDD4F682077A238B4FD9A47C4CE6F84B1B4829A86580A4AB794820E6CD4C1E98CFB7BDCE23E09B54566BD6443
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# comdlg.tcl --.#.#.Some functions needed for the common dialog boxes. Probably need to go.#.in a different file..#.# Copyright (c) 1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# tclParseConfigSpec --.#.#.Parses a list of "-option value" pairs. If all options and.#.values are legal, the values are stored in.#.$data($option). Otherwise an error message is returned. When.#.an error happens, the data() array may have been partially.#.modified, but all the modified members of the data(0 array are.#.guaranteed to have valid values. This is different than.#.Tk_ConfigureWidget() which does not modify the value of a.#.widget record if any error occurs..#.# Arguments:.#.# w = widget record to modify. Must be the pathname of a widget..#.# specs = {.# {-commandlineswitch resourceName ResourceClass defaultValue verifier}.# {....}.# }.#.# flags = currently unused..#.# argList
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32784
                                                                                                                                                                                                                          Entropy (8bit):4.906598115585926
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:GkptctbjWz4xjtyU/W1ZQWSLEwYGl7nZH5J+ry3+uQlLW44qvRHRJStCO2FfB25b:GkpeZWz4miZeG7J+rMYXaGGWFOYoV
                                                                                                                                                                                                                          MD5:8B5B8B6D49F4CA36B8662923DCF9A46C
                                                                                                                                                                                                                          SHA1:BCD6CA7451BDFB22311D9D54FBABB116D4A7A687
                                                                                                                                                                                                                          SHA-256:7E1EAA998B1D661E9B4B72A4598A534B8311AB75D444525DD613EC73F8126750
                                                                                                                                                                                                                          SHA-512:D7E20377E2FBD147A68E4B647D4F09A1894A203F2FA5435B09AD2B6998FFC2F70222BD2808B6A1D1B6A96271F04E7C7A4E6AB0EAE4C97C7C728A6645C499391F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# console.tcl --.#.# This code constructs the console window for an application. It.# can be used by non-unix systems that do not have built-in support.# for shells..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..# Copyright (c) 2007-2008 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# TODO: history - remember partially written command..namespace eval ::tk::console {. variable blinkTime 500 ; # msecs to blink braced range for. variable blinkRange 1 ; # enable blinking of the entire braced range. variable magicKeys 1 ; # enable brace matching and proc/var recognition. variable maxLines 600 ; # maximum # of lines buffered in console. variable showMatches 1 ; # show multiple expand matches. variable useFontchooser [llength [info command ::tk::fontchooser]]. variable inPlugi
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):6025
                                                                                                                                                                                                                          Entropy (8bit):4.79563398407639
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:WfPQCAV8OgciKHKKcmQH+DmlYm4Kapo9mBc//IWxIb:WfPQCAVviKHKK4H+DmT4Kapo4cnDOb
                                                                                                                                                                                                                          MD5:EAC165BD7EA915B44FAEC016250E0B06
                                                                                                                                                                                                                          SHA1:7D205F2720E00FBDA5C0AA908CAC3F66BBC84E56
                                                                                                                                                                                                                          SHA-256:6D7BD4A280272E7A2748555CFFFF4FCA7CC57CE611AEB2382E3C80CDD1868D22
                                                                                                                                                                                                                          SHA-512:22D5794E1FF3B94365C560A310CC17B4A27BEA87DBF423DFB44273443477372013B19ED33E170EAB15A1F06BA9186BA2FC184A3751449E7EDC760D23A12B1666
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# dialog.tcl --.#.# This file defines the procedure tk_dialog, which creates a dialog.# box containing a bitmap, a message, and one or more buttons..#.# Copyright (c) 1992-1993 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#.# ::tk_dialog:.#.# This procedure displays a dialog box, waits for a button in the dialog.# to be invoked, then returns the index of the selected button. If the.# dialog somehow gets destroyed, -1 is returned..#.# Arguments:.# w -..Window to use for dialog top-level..# title -.Title to display in dialog's decorative frame..# text -.Message to display in dialog..# bitmap -.Bitmap to display in dialog (empty string means none)..# default -.Index of button that is to display the default ring.#..(-1 means none)..# args -.One or more strings to display in buttons across the.#..bottom of t
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16950
                                                                                                                                                                                                                          Entropy (8bit):4.934745561122632
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:P/eFkH2fRdOnOeQod3tCAERebMIDlXVQgXwVviw:P2FDqUy8V
                                                                                                                                                                                                                          MD5:BE28D16510EE78ECC048B2446EE9A11A
                                                                                                                                                                                                                          SHA1:4829D6E8AB8A283209FB4738134B03B7BD768BAD
                                                                                                                                                                                                                          SHA-256:8F57A23C5190B50FAD00BDEE9430A615EBEBFC47843E702374AE21BEB2AD8B06
                                                                                                                                                                                                                          SHA-512:F56AF7020531249BC26D88B977BAFFC612B6566146730A681A798FF40BE9EBC04D7F80729BAFE0B9D4FAC5B0582B76F9530F3FE376D42A738C9BC4B3B442DF1F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# entry.tcl --.#.# This file defines the default bindings for Tk entry widgets and provides.# procedures that help in implementing those bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a selection)..# pressX -..X-coordinate at which the mouse button was pressed..# selectMode -..The style of selection currently underway:.#...char, word, or line..# x, y -..La
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4857
                                                                                                                                                                                                                          Entropy (8bit):4.7675047842795895
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:mumhRUI7F2WyHm6BUyNhEf6jUHKRUI7F2WyQe6L763AcnK0/61sk2ko5AgEplauw:ERUQFU52CNRUQFpLOQIG1sk2TCLplauw
                                                                                                                                                                                                                          MD5:7EA007F00BF194722FF144BE274C2176
                                                                                                                                                                                                                          SHA1:6835A515E85A9E55D5A27073DAE1F1A5D7424513
                                                                                                                                                                                                                          SHA-256:40D4E101A64B75361F763479B01207AE71535337E79CE6E162265842F6471EED
                                                                                                                                                                                                                          SHA-512:E2520EB065296C431C71DBBD5503709CF61F93E74FE324F4F8F3FE13131D62435B1E124D38E2EC84939B92198A54B8A71DFC0A8D32F0DD94139C54068FBCAAF2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# focus.tcl --.#.# This file defines several procedures for managing the input.# focus..#.# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_focusNext --.# This procedure returns the name of the next window after "w" in.# "focus order" (the window that should receive the focus next if.# Tab is typed in w). "Next" is defined by a pre-order search.# of a top-level and its non-top-level descendants, with the stacking.# order determining the order of siblings. The "-takefocus" options.# on windows determine whether or not they should be skipped..#.# Arguments:.# w -..Name of a window...proc ::tk_focusNext w {. set cur $w. while {1} {...# Descend to just before the first child of the current widget....set parent $cur..set children [winfo children $cur]..set i -1...# Look for the next sibling that isn't a top-level....while {1} {.. incr i..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15840
                                                                                                                                                                                                                          Entropy (8bit):4.7139053935905535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:hrAVUJgzMAP2Xg7V5M8Zyc8Ck/YN9G4EM8CPo:hrAVUJgzMAP2Xg7V5MgycO/YpEX
                                                                                                                                                                                                                          MD5:9324DBBE37502E149474E05A3448B6E3
                                                                                                                                                                                                                          SHA1:5584B4EE3BF25E95EE6919437D066586060B6E36
                                                                                                                                                                                                                          SHA-256:CEB558FB76A2C85924CD5F7D3A64E77582E1D461DD9A3C10FEDB4608AD440F5B
                                                                                                                                                                                                                          SHA-512:C688676452F89EC432E93A64AC369CC0B82B19D8D38D2C4034888551591F59D87548FAE12A98EE7735540779566DEB400C27BEAD2C141A9F971BAF9E61C218C6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# fontchooser.tcl -.#.#.A themeable Tk font selection dialog. See TIP #324..#.# Copyright (C) 2008 Keith Vetter.# Copyright (C) 2008 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::fontchooser {. variable S.. set S(W) .__tk__fontchooser. set S(fonts) [lsort -dictionary [font families]]. set S(styles) [list \. [::msgcat::mc "Regular"] \. [::msgcat::mc "Italic"] \. [::msgcat::mc "Bold"] \. [::msgcat::mc "Bold Italic"] \. ].. set S(sizes) {8 9 10 11 12 14 16 18 20 22 24 26 28 36 48 72}. set S(strike) 0. set S(under) 0. set S(first) 1. set S(sampletext) [::msgcat::mc "AaBbYyZz01"]. set S(-parent) .. set S(-title) [::msgcat::mc "Font"]. set S(-command) "". set S(-font) TkDefaultFont.}..proc ::tk:
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15978
                                                                                                                                                                                                                          Entropy (8bit):4.8947909611129905
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:xj0OECzN+8JERNLKZhbgIDx3VM5BxBTSgvpn8WYYW5Xb50To3u8PYHPtJYa5PWDx:xrDJE36a7BegvV8hFI8gvXaSn9HqD/U0
                                                                                                                                                                                                                          MD5:105529990CEE968AA5EE3BC827A81A0F
                                                                                                                                                                                                                          SHA1:559BD1AABD1D4719EDB60448CF111F78365A57A9
                                                                                                                                                                                                                          SHA-256:DE0195CCFB6482CCA390C94E91B7877F47742E7A9468CAF362B39AA36305D33C
                                                                                                                                                                                                                          SHA-512:03CB42DFF7AC4F801AA7FFE8A4F07555CCE6874AA1B7F568ACF0299E4DD7F440179838485777F15183EE7C057CCB35868672B1783FBFE67B51D97DBBDAC85281
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# iconlist.tcl.#.#.Implements the icon-list megawidget used in the "Tk" standard file.#.selection dialog boxes..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..# Copyright (c) 2009 Donal K. Fellows.#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#.# API Summary:.#.tk::IconList <path> ?<option> <value>? ....#.<path> add <imageName> <itemList>.#.<path> cget <option>.#.<path> configure ?<option>? ?<value>? ....#.<path> deleteall.#.<path> destroy.#.<path> get <itemIndex>.#.<path> index <index>.#.<path> invoke.#.<path> see <index>.#.<path> selection anchor ?<int>?.#.<path> selection clear <first> ?<last>?.#.<path> selection get.#.<path> selection includes <item>.#.<path> selection set <first> ?<last>?...package require Tk 8.6..::tk::Megawidget create ::tk::IconList ::tk::FocusableWidget {. variable w canvas sbar accel accelCB fill font index \..itemList itemsPerColumn list maxIH maxIW maxTH maxTW noSc
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10883
                                                                                                                                                                                                                          Entropy (8bit):6.026473720997027
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:TJjPyYK20kt4zHIXM2MxGwwOw0ac5lCssUOixDgzAjTXBHVXPZmEhr:pO2gz6MioacR2iBgzsFHX5r
                                                                                                                                                                                                                          MD5:2652AAD862E8FE06A4EEDFB521E42B75
                                                                                                                                                                                                                          SHA1:ED22459AD3D192AB05A01A25AF07247B89DC6440
                                                                                                                                                                                                                          SHA-256:A78388D68600331D06BB14A4289BC1A46295F48CEC31CEFF5AE783846EA4D161
                                                                                                                                                                                                                          SHA-512:6ECFBB8D136444A5C0DBBCE2D8A4206F1558BDD95F111D3587B095904769AC10782A9EA125D85033AD6532EDF3190E86E255AC0C0C81DC314E02D95CCA86B596
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# icons.tcl --.#.#.A set of stock icons for use in Tk dialogs. The icons used here.#.were provided by the Tango Desktop project which provides a.#.unified set of high quality icons licensed under the.#.Creative Commons Attribution Share-Alike license.#.(http://creativecommons.org/licenses/by-sa/3.0/).#.#.See http://tango.freedesktop.org/Tango_Desktop_Project.#.# Copyright (c) 2009 Pat Thoyts <patthoyts@users.sourceforge.net>..namespace eval ::tk::icons {}..image create photo ::tk::icons::warning -data {. iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABHNCSVQICAgIfAhkiAAABSZJREFU. WIXll1toVEcYgL+Zc87u2Yu7MYmrWRuTJuvdiMuqiJd4yYKXgMQKVkSjFR80kFIVJfWCWlvpg4h9. 8sXGWGof8iKNICYSo6JgkCBEJRG8ImYThNrNxmaTeM7pQ5IlJkabi0/9YZhhZv7///4z/8zPgf+7. KCNRLgdlJijXwRyuDTlcxV9hbzv8nQmxMjg+XDtiOEplkG9PSfkztGmTgmFQd+FCVzwa3fYN/PHZ. AcpBaReicW5xcbb64IEQqko8Lc26d/58cxS+/BY6hmJvyEfQBoUpwWCmW1FErKaGWHU13uRk4QkE. UtxQNFR7QwIoB4eiKD9PWbVKbb10CZmaCqmpxCormRYO26QQx85B0mcD+AeK0xYvHqu1tNDx+DH6. g
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):322
                                                                                                                                                                                                                          Entropy (8bit):4.341180398587801
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:nVhmHdeA1xNZgkrIf3Ju4dFi6VbGWrWhr3W7FxmVFraGVAJFKyVQR7icrtpwB:nPqf1fZgZA4FJbB6dm7FUjAJVVMM
                                                                                                                                                                                                                          MD5:FC8A86E10C264D42D28E23D9C75E7EE5
                                                                                                                                                                                                                          SHA1:F1BA322448D206623F8FE734192F383D8F7FA198
                                                                                                                                                                                                                          SHA-256:2695ADFF8E900C31B4D86414D22B8A49D6DD865CA3DD99678FA355CDC46093A8
                                                                                                                                                                                                                          SHA-512:29C2DF0D516B5FC8E52CB61CFCD07AF9C90B40436DFE64CEFDB2813C0827CE65BA50E0828141256E2876D4DC251E934A6854A8E0B02CDAF466D0389BD778AEF0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:README - images directory..This directory includes images for the Tcl Logo and the Tcl Powered.Logo. Please feel free to use the Tcl Powered Logo on any of your.products that employ the use of Tcl or Tk. The Tcl logo may also be.used to promote Tcl in your product documentation, web site or other.places you so desire..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):32900
                                                                                                                                                                                                                          Entropy (8bit):5.235207715374815
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:gGTVOEcRWsdEmhp6k/GLrPMlK3pJr/IbYDGDMtBF2Fz6fsFA/fSvqHWukLI2d0Nr:gGTVOEcRWsdEvLrPJ5Jr/IbYDGDMtBFh
                                                                                                                                                                                                                          MD5:45175418859AF67FE417BD0A053DB6E5
                                                                                                                                                                                                                          SHA1:2B499B7C4EBC8554ECC07B8408632CAF407FB6D5
                                                                                                                                                                                                                          SHA-256:F3E77FD94198EC4783109355536638E9162F9C579475383074D024037D1797D3
                                                                                                                                                                                                                          SHA-512:114A59FD6B99FFD628BA56B8E14FB3B59A0AB6E752E18DEA038F85DBC072BF98492CE9369D180C169EDE9ED2BD521D8C0D607C5E4988F2C83302FC413C6D6A4C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL/TK LOGO.ILLUS).%%CreationDate: (8/1/96) (4:58 PM).%%BoundingBox: 251 331 371 512.%%HiResBoundingBox: 251.3386 331.5616 370.5213 511.775.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%DocumentCustomColors: (TCL RED).%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 90 576 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Level 2 Emul
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 68 x 100
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2341
                                                                                                                                                                                                                          Entropy (8bit):6.9734417899888665
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:qF/mIXn3l7+ejbL/4nZEsKPKer1OPQqVRqJbPpRRKOv/UVO47f:81nHL4T0KorxvRKkc847f
                                                                                                                                                                                                                          MD5:FF04B357B7AB0A8B573C10C6DA945D6A
                                                                                                                                                                                                                          SHA1:BCB73D8AF2628463A1B955581999C77F09F805B8
                                                                                                                                                                                                                          SHA-256:72F6B34D3C8F424FF0A290A793FCFBF34FD5630A916CD02E0A5DDA0144B5957F
                                                                                                                                                                                                                          SHA-512:10DFE631C5FC24CF239D817EEFA14329946E26ED6BCFC1B517E2F9AF81807977428BA2539AAA653A89A372257D494E8136FD6ABBC4F727E6B199400DE05ACCD5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aD.d...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....D.d........H......*\...z..Ht@Q...92.p...z.$.@@.E..u.Y.2..0c..q.cB.,[..... ..1..qbM.2~*].....s...S.@.L.j..#..\......h..........].D(..m......@.Z....oO...3=.c...G".(..pL...q]..%....[...#...+...X.h....^.....
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 43 x 64
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1670
                                                                                                                                                                                                                          Entropy (8bit):6.326462043862671
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:PF/mIXn3l7+ejbL/4xsgq4sNC6JYp6s/pmp76F:/1nHL404raM/op2
                                                                                                                                                                                                                          MD5:B226CC3DA70AAB2EBB8DFFD0C953933D
                                                                                                                                                                                                                          SHA1:EA52219A37A140FD98AEA66EA54685DD8158D9B1
                                                                                                                                                                                                                          SHA-256:138C240382304F350383B02ED56C69103A9431C0544EB1EC5DCD7DEC7A555DD9
                                                                                                                                                                                                                          SHA-512:3D043F41B887D54CCADBF9E40E48D7FFF99B02B6FAF6B1DD0C6C6FEF0F8A17630252D371DE3C60D3EFBA80A974A0670AF3747E634C59BDFBC78544D878D498D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a+.@...............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....+.@........H. .z..(tp......@...92....#. A.......C.\.%...)Z..1a.8s..W/..@....3..C...y$.GW.....5.FU..j..;.F(Pc+W.-..X.D-[.*g....F..`.:mkT...Lw...A/.....u.7p..a..9P.....q2..Xg..G....3}AKv.\.d..yL.>..1.#
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 354 x 520
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):11000
                                                                                                                                                                                                                          Entropy (8bit):7.88559092427108
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:d+nY6zludc/We/yXy9JHBUoIMSapQdrGlapzmyNMK1vbXkgMmgFW/KxIq3NhZe:YnY6p4c/OCHyowaGUaCcMK1vbXNwFW/l
                                                                                                                                                                                                                          MD5:45D9B00C4CF82CC53723B00D876B5E7E
                                                                                                                                                                                                                          SHA1:DDD10E798AF209EFCE022E97448E5EE11CEB5621
                                                                                                                                                                                                                          SHA-256:0F404764D07A6AE2EF9E1E0E8EAAC278B7D488D61CF1C084146F2F33B485F2ED
                                                                                                                                                                                                                          SHA-512:6E89DACF2077E1307DA05C16EF8FDE26E92566086346085BE10A7FD88658B9CDC87A3EC4D17504AF57D5967861B1652FA476B2DDD4D9C6BCFED9C60BB2B03B6F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89ab.................f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3..............f..3.............f..3..........f.3...f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3.............f..3............f..3.............f..3....f..f.f..ff.f3.f..3..3.3..3f.33.3...........f..3...f..f..f..f.ff.3f..f..f..f.f.ff.3f..f..f..f..f.ff.3f..ff.ff.ff.fffff3ff.f3.f3.f3.f3ff33f3.f..f..f..f.ff.3f..3..3..3..3.f3.33..3..3..3.3.f3.33..3..3..3..3.f3.33..3f.3f.3f.3ff3f33f.33.33.33.33f33333.3..3..3..3.f3.33.............f..3.............f..3..............f..3....f..f..f..ff.f3.f..3..3..3..3f.33.3............f..3...............w..U..D..".....................w..U..D..".....................w..U..D..".................wwwUUUDDD"""......,....b..........H......*\....#J.H....3j.... '.;p....(.8X..^.0c.I...z8O.\.....:....$..Fu<8`...P.>%I.gO.C.h-..+.`....@..h....dJ.?...K...H.,U.._.#...g..[.*^.x.....J.L.!.'........=+eZ..i..ynF.8...].y|..m.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 87a, 120 x 181
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3889
                                                                                                                                                                                                                          Entropy (8bit):7.425138719078912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:9qqbIh+cE4C8ric/jxK5mxsFBu3/0GIJ6Qap1Y5uMiR8pw5rB/SgijDb+TOh:hy+mnZ7xK5IsTwDQmkdiiG5rB/BE+6h
                                                                                                                                                                                                                          MD5:BD12B645A9B0036A9C24298CD7A81E5A
                                                                                                                                                                                                                          SHA1:13488E4F28676F1E0CE383F80D13510F07198B99
                                                                                                                                                                                                                          SHA-256:4D0BD3228AB4CC3E5159F4337BE969EC7B7334E265C99B7633E3DAF3C3FCFB62
                                                                                                                                                                                                                          SHA-512:F62C996857CA6AD28C9C938E0F12106E0DF5A20D1B4B0B0D17F6294A112359BA82268961F2A054BD040B5FE4057F712206D02F2E668675BBCF6DA59A4DA0A1BB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF87ax............................................................................z.....{..o.....m..b...`{.X....vy...hk.Um.N...I`.D..Z^.LP.?R.;!....?C.5C.3#.l..,6.*&.15...`..#(.If.y.....l...._..#/...Hm.>_.y..4R.k..#6..._......w..*K.^.."<.....G{.w..3_."C.Q..F....v..!K...v.2m.)_.[..!R.u.1t.g..)f. X.O..E..1z.g. _.Z..D..:..0..Z.. f.D..0..'z..m.N..C../.z.svC.q/.m.ze7.\..P..I..1%.,...............................................................................................................................................................................................................................................................................................................................................................................................,....x..........H.......D..!...7.PAQ...._l8.... C.<.a...*.x....0q.. ..M.%.<.HBe.@.....Q..7..XC..P..<z3..X...P.jA.%'@.J.lV.......R.,..+....t....7h.....(..a...+^.'..7..L.....V...s..$....a.....8`.9..}K......
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PostScript document text conforming DSC level 3.0, type EPS
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):27809
                                                                                                                                                                                                                          Entropy (8bit):5.331778921404698
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:geQTVOEcRWsdEmhp6k/GLrPMlK3pJrNIbYDGDMtBgu2Fz6lR5G/r+FWaGK:gnTVOEcRWsdEvLrPJ5JrNIbYDGDMtB9L
                                                                                                                                                                                                                          MD5:BA1051DBED2B8676CAA24593B88C91B2
                                                                                                                                                                                                                          SHA1:8A58FC19B20BFDC8913515D9B32CCBF8ACF92344
                                                                                                                                                                                                                          SHA-256:2944EBC4AF1894951BF9F1250F4E6EDF811C2183745950EA9A8A926715882CF7
                                                                                                                                                                                                                          SHA-512:4260CEBA7DA9463F32B0C76A2AC19D2B20C8FE48CFBA3DC7AF748AAE15FA25DCBDA085072DF7EFC8F4B4F304C7ED166FE9F93DC903E32FA1874E82D59E544DEF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:%!PS-Adobe-3.0 EPSF-3.0.%%Creator: Adobe Illustrator(TM) 5.5.%%For: (Bud Northern) (Mark Anderson Design).%%Title: (TCL PWRD LOGO.ILLUS).%%CreationDate: (8/1/96) (4:59 PM).%%BoundingBox: 242 302 377 513.%%HiResBoundingBox: 242.0523 302.5199 376.3322 512.5323.%%DocumentProcessColors: Cyan Magenta Yellow.%%DocumentSuppliedResources: procset Adobe_level2_AI5 1.0 0.%%+ procset Adobe_IllustratorA_AI5 1.0 0.%AI5_FileFormat 1.2.%AI3_ColorUsage: Color.%%CMYKCustomColor: 0 0.45 1 0 (Orange).%%+ 0 0.25 1 0 (Orange Yellow).%%+ 0 0.79 0.91 0 (PANTONE Warm Red CV).%%+ 0 0.79 0.91 0 (TCL RED).%AI3_TemplateBox: 306 396 306 396.%AI3_TileBox: 12 12 600 780.%AI3_DocumentPreview: Macintosh_ColorPic.%AI5_ArtSize: 612 792.%AI5_RulerUnits: 0.%AI5_ArtFlags: 1 0 0 1 0 0 1 1 0.%AI5_TargetResolution: 800.%AI5_NumLayers: 1.%AI5_OpenToView: 102 564 2 938 673 18 1 1 2 40.%AI5_OpenViewLayers: 7.%%EndComments.%%BeginProlog.%%BeginResource: procset Adobe_level2_AI5 1.0 0.%%Title: (Adobe Illustrator (R) Version 5.0 Le
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 64 x 100
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1615
                                                                                                                                                                                                                          Entropy (8bit):7.461273815456419
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:aE45BzojC3r1WAQ+HT2gAdKhPFZ/ObchgB8:V5Gb1WN+yfcObmgW
                                                                                                                                                                                                                          MD5:DBFAE61191B9FADD4041F4637963D84F
                                                                                                                                                                                                                          SHA1:BD971E71AE805C2C2E51DD544D006E92363B6C0C
                                                                                                                                                                                                                          SHA-256:BCC0E6458249433E8CBA6C58122B7C0EFA9557CBC8FB5F9392EED5D2579FC70B
                                                                                                                                                                                                                          SHA-512:ACEAD81CC1102284ED7D9187398304F21B8287019EB98B0C4EC7398DD8B5BA8E7D19CAA891AA9E7C22017B73D734110096C8A7B41A070191223B5543C39E87AF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a@.d.............................f.................f...ff.f3.f..33.3.........f..ff.f3.33.3.f..f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....@.d....@.pH,..E.... ..(...H$..v..j....K....q..5L......^).3.Y7..r..u.v|g..om...\iHl..p...`G..\~....fn[q...P.g.Z.l....y...\.l......f.Z.g...%%....e...e...)....O.f..e. ....O..qf..%..(.H.u..]..&....#4.......@.).....u!.M..2. ..PJ..#..T..a.....P.Gi... <Hb....x..z.3.X.O..f.........].Bt..lB.Q.r...9pP....&...L. ..,`[.....E6.Q.....?.#L......|g........N....[.._........."4......b....G6.........m.zI].....I.@.......I.9...glew...2.B..c>./..2....x.....<...{...7;.....y.I.....4G.Qj0..7..%.W.V...?!..[...X..=..k.h..[Q<.....0.B....(P.x.,.......8O*Z.8P!.$....u.c..Ea!..eC....CB.. .H..E..#..C..E...z..&.Nu........c.0..#.T.M.U........l.p @..s.|..pf!..&.......8.#.8.....*..J>. .t..h6(........#..0.A...*!..)...x..u.Z....*%..H.....*.......`......|.....1.......&.....T*...f.l...
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 97 x 150
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2489
                                                                                                                                                                                                                          Entropy (8bit):7.708754027741608
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:/Ev7JJ+3uvz/Hwbcp7igaIwjBui7qFxIIOdJXcI+Ks:M9oWz/7pZAV7qPIImJXtXs
                                                                                                                                                                                                                          MD5:711F4E22670FC5798E4F84250C0D0EAA
                                                                                                                                                                                                                          SHA1:1A1582650E218B0BE6FFDEFFD64D27F4B9A9870F
                                                                                                                                                                                                                          SHA-256:5FC25C30AEE76477F1C4E922931CC806823DF059525583FF5705705D9E913C1C
                                                                                                                                                                                                                          SHA-512:220C36010208A87D0F674DA06D6F5B4D6101D196544ABCB4EE32378C46C781589DB1CE7C7DFE6471A8D8E388EE6A279DB237B18AF1EB9130FF9D0222578F1589
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aa...............................f.................f...ff.f3.f..33.3............f..ff.f3.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,....a......@.pH,...r.l:..TB.T..V..z..H.j..h...&.......t"....F...d..gN~Y...g....}..r....g.....o...g.......Y.w..W......N....Z....W....f...tL.~.f....New............W.M.r.........O.q........W-./i.*...`..z..F9.../9..-.......$6..G..S...........zB.,nw.64...e4.......HOt......f.....)..OX..C.eU.(.Qh.....T..<Q.Y.P.L.YxT....2........ji..3.^)zz..O.a..6 ...TZ........^...7.....>|P.....w$...k.ZF.\R.u....F.]Z.--(v+)[Y....=.!.W..+.]..]._.....&..../Ap...j...!..b.:...{.^.=.`...U.....@Hf..\?.(..Lq@.........0..L...a...&.!.....]#..]G \..q...A.H.X[...(.W......,...1a..B...W(.t.8.AdG.)..(P=...Uu.u..A.KM\...'r.R./.W..d2a.0..G...?...B......#H........1Q.0...R....%+...0.I..{.<......QV.tz'.yn.E.p..0i.I.g......L....%....K...A.l.ph.Q.1e...Z....g..2e...smU&d;.J..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 113 x 175
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2981
                                                                                                                                                                                                                          Entropy (8bit):7.758793907956808
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:AmEwM8ioQoHJQBTThKVI7G78NLL120GFBBFXJRxlu+BmO/5lNqm7Eq:B57QoHJQt4II8BZ+jxluZO/5lNqm7Eq
                                                                                                                                                                                                                          MD5:DA5FB10F4215E9A1F4B162257972F9F3
                                                                                                                                                                                                                          SHA1:8DB7FB453B79B8F2B4E67AC30A4BA5B5BDDEBD3B
                                                                                                                                                                                                                          SHA-256:62866E95501C436B329A15432355743C6EFD64A37CFB65BCECE465AB63ECF240
                                                                                                                                                                                                                          SHA-512:990CF306F04A536E4F92257A07DA2D120877C00573BD0F7B17466D74E797D827F6C127E2BEAADB734A529254595918C3A5F54FDBD859BC325A162C8CD8F6F5BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89aq...............................f.................f...ff.f3.f..33.3............f..ff.f3.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3................................................................!.. -dl-.!.......,....q......@.pH,...r.l:....A}H...v..R......D.VF..,%M....^.....fyzU.P..f...i.....t..Uqe..N..Z..i......~....g......u.....g......\...h.....P...h.....Q..g....Z..h......]......\...M...[..s...c2.+R.$. ......#.....)v..4....MO.b.....9......[.M.........h'..<-..=.....HQD....D?.~......W7. ..V.W0..l....*0p}..KP?c.\@KW.S(..M..B.....-q...S2...*.,..P.{....F..._MAn ....i.Y3............zh.y.j@...a876...ui.i..;K.........p...`.,}w....tv.m...Y..........;.;.e).e&.......-.NC.*4..(........*..F........[,w....f......E....h..a3.T.^.........)...C.N8.h\T...+&.z....g]H..B..#.t6..Z.....j.-..N......TI....A........M?..Q&V'...Mb.f.x...h.$r.U .9..Ci. ].4.Zb..@...X....%..<..b)V!........Y)x......T.....h.p.d..h..(........]@.**J.M.U.Jf...Y.:....F..g:..d..6q.-..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 130 x 200
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3491
                                                                                                                                                                                                                          Entropy (8bit):7.790611381196208
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ROGuxkQ9mcV7RXcECEtqCa+6GK8WseNXhewFIp9ZmL4u:ROGwpVOEbqCrWsUhtIk4u
                                                                                                                                                                                                                          MD5:A5E4284D75C457F7A33587E7CE0D1D99
                                                                                                                                                                                                                          SHA1:FA98A0FD8910DF2EFB14EDAEC038B4E391FEAB3C
                                                                                                                                                                                                                          SHA-256:BAD9116386343F4A4C394BDB87146E49F674F687D52BB847BD9E8198FDA382CC
                                                                                                                                                                                                                          SHA-512:4448664925D1C1D9269567905D044BBA48163745646344E08203FCEF5BA1524BA7E03A8903A53DAF7D73FE0D9D820CC9063D4DA2AA1E08EFBF58524B1D69D359
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a................................f.................f...ff.f3.f..33.3............f..ff.3f.33.3.f..ff.ff.ffff3ff333f.3f.33.33f.3...................................................................!.. -dl-.!.......,...........@.pH,...r.l:..T..F$XIe..V$.x..V.Z.z..F.pxd~..........{....o....l..{.b...hi[}P.k...y.....y.f.._R.\...............m.....y.....x......^.Q...j.....\S.....^.......l......]...[.......).....{....7...`..<...`..">..i.?/..@............>..Z.z@....0B..r...j.V.I.@..;%R...*...J.p.A.t.*..$A*...>`.....@g5BP.A..p.x.............q..8...... ...(.Q..#..@...F..YSK..M..#o.....D.m..-.....k}...BT..V......'.....`.d..~;..9+..6...<b.eZ..y^0]0..I...=.6.....}.0<.Z...M...Y1*35.e.....b...U0F~.-.HT......l2.s.q`-....y...e....dPZ....~.zT.M.... "r.E/k. ...*..Lj@'........Pcd&.(..mxF_w.."K..x!..--Y`..A.....Be.jH.A..\..j.....du#.....]^...>......].i.FMO..].9n1",Y...F...EW.9.....0TY.T...Cv!i`%...Hz@.]..U.!Y...#Dv&pi.z(.mn.A....@Q.0.%...&.4.v.cw(.`cd'|..M9..."...,*.......
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 48 x 75
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1171
                                                                                                                                                                                                                          Entropy (8bit):7.289201491091023
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:DOfHIzP8hqiF+oyPOmp3XHhPBlMVvG0ffWLpfc:DGoPM+o0OmZXHhOv5WRc
                                                                                                                                                                                                                          MD5:7013CFC23ED23BFF3BDA4952266FA7F4
                                                                                                                                                                                                                          SHA1:E5B1DED49095332236439538ECD9DD0B1FD4934B
                                                                                                                                                                                                                          SHA-256:462A8FF8FD051A8100E8C6C086F497E4056ACE5B20B44791F4AAB964B010A448
                                                                                                                                                                                                                          SHA-512:A887A5EC33B82E4DE412564E86632D9A984E8498F02D8FE081CC4AC091A68DF6CC1A82F4BF99906CFB6EA9D0EF47ADAC2D1B0778DCB997FB24E62FC7A6D77D41
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89a0.K.............................f.................f...ff.f3.f..33.3.........f..ff.f3.3f.33.3.f..ff.ff.f3ff333f.3f.33.33f.3......................................................................!.. -dl-.!.......,....0.K....@.pH,...GD.<:..%SR.Z......<.V.$l.....z......:.. .|v[D..f...z.W.G.Vr...NgsU.yl..qU..`.......`fe`.......Fg....(.&...g.Y.. .."..q.V.$.'.Ez.W....y...Y.U...(#Xrf.........Xux.U..........(U.4...X....G.B..t..1S...R..Y. ...l ..".>.h......,%K....A.....<s....#..8.iK.....a.y$h..DQh.PE)....6.....MyL.qzF..... ."..Y0..a......2..*t..Ma..b...M..R.....\..st..=....Q......,>s`....Qt.,..B.R.....!.$..%.....(...s...B.T...`,".h(. D....8..dC..\Q.p.......x.#A.....:..du..(D.XV......7....S.#n8a....2`...f.:G,...==(......`!..$...t....b..../N|...f..J.x... P&.|.d._!N...].1w.3D.0!....@o&H...N.B.J....pz8..w.i....=r.............@5.-!.......H."..[.j.AB<..p....h...V.D..6.h...ab1F.g...I !.V~.H..V.........:.G..|c...,.....TD5..c[.W.....LC.....FJ..71[..lH.M.....8.:$......
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:GIF image data, version 89a, 100 x 100
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5473
                                                                                                                                                                                                                          Entropy (8bit):7.754239979431754
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:+EqG96vSGfyJZ26G6U1LI7nTD2enhjc+2VBnOqcUERVIim:+46KcyJI6G6uU7/LhjlkhQR7m
                                                                                                                                                                                                                          MD5:048AFE69735F6974D2CA7384B879820C
                                                                                                                                                                                                                          SHA1:267A9520C4390221DCE50177E789A4EBD590F484
                                                                                                                                                                                                                          SHA-256:E538F8F4934CA6E1CE29416D292171F28E67DA6C72ED9D236BA42F37445EA41E
                                                                                                                                                                                                                          SHA-512:201DA67A52DADA3AE7C533DE49D3C08A9465F7AA12317A0AE90A8C9C04AA69A85EC00AF2D0069023CD255DDA8768977C03C73516E4848376250E8D0D53D232CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:GIF89ad.d...................RJJ...B99.......RBB..B11ZBB!....R991!!...)....{{B!!R)).JJ.ss.ZZ.BB.kk.RR.JJ.BB9...JJR!!.ZZ.BB.11.99.{s.sk.kc.cZ.ZR.JB.ZR.JB.JB.RJ.B9.91.B9...{.JB.91.B9.B9.1){)!.)!.9)..ZR.JB{91.cR{1).ZJ.ZJ.RB.J9.B1.B1.9).1!....{B9.{k.scc1).kZZ)!c)!.9).B1.9).9).1!.1!.1!.B).9!.9!.1..).....{.sZ1)R)!.B1.B1.ZBR!..9).ZB.9).R9.R9.1!.J1.J1.B).B).9!.9!.1..1..).....sZ.J9.ZB.cJJ!.{1!.B).9!{)..9!.J).B!.B!.9..R1).kJ)!.B1{9).R9.cB.Z9.Z9.B).Z9.B).R1.9!.R1.J).J).B!.1..9....{.s.J9.{Z.ZB.sR.kJk1!.cB.cB.R1.R).1..B!.J!.B.....R91.J1).c.kJ.J).Z1.B!.B!..9!..{R.sJ.Z9.R1{9!..s.R9.Z...J91Z9){B)...............B91..1)!..............................RJR............B)1......R19........BJ.9B..{..s{......!.......,....d.d.@............0@PHa....*.p...7.8.y...C.s6Z.%Q.#s.`:B.N....4jd.K.0..|y....F@.......1~ ......'Y.B"C&R.V.R.4$k.3...D.......Ef*Y3..M........BDV._.....\..).]..>s..$H\%y0WL...d.......D..'..v..1Kz.Zp$;S
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2267
                                                                                                                                                                                                                          Entropy (8bit):5.097909341674822
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:JlZuZcRTvy3DauG4+bHnr32s3eGw8YKxPiOXR3ojdS+mFf:JScFaz+bL3e8n3XR3ojdtOf
                                                                                                                                                                                                                          MD5:C88F99DECEC11AFA967AD33D314F87FE
                                                                                                                                                                                                                          SHA1:58769F631EB2C8DED0C274AB1D399085CC7AA845
                                                                                                                                                                                                                          SHA-256:2CDE822B93CA16AE535C954B7DFE658B4AD10DF2A193628D1B358F1765E8B198
                                                                                                                                                                                                                          SHA-512:4CD59971A2614891B2F0E24FD8A42A706AE10A2E54402D774E5DAA5F6A37DE186F1A45B1722A7C0174F9F80625B13D7C9F48FDB03A7DDBC6E6881F56537B5478
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:This software is copyrighted by the Regents of the University of.California, Sun Microsystems, Inc., Scriptics Corporation, ActiveState.Corporation, Apple Inc. and other parties. The following terms apply to.all files associated with the software unless explicitly disclaimed in.individual files...The authors hereby grant permission to use, copy, modify, distribute,.and license this software and its documentation for any purpose, provided.that existing copyright notices are retained in all copies and that this.notice is included verbatim in any distributions. No written agreement,.license, or royalty fee is required for any of the authorized uses..Modifications to this software may be copyrighted by their authors.and need not follow the licensing terms described here, provided that.the new terms are clearly indicated on the first page of each file where.they apply...IN NO EVENT SHALL THE AUTHORS OR DISTRIBUTORS BE LIABLE TO ANY PARTY.FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQ
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14594
                                                                                                                                                                                                                          Entropy (8bit):4.895853767062079
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:ZBjtAc4YusFvbg36UFchqHjNw8wSdy+1a22YDE/q:ZFgqUBjW8RQcf
                                                                                                                                                                                                                          MD5:C33963D3A512F2E728F722E584C21552
                                                                                                                                                                                                                          SHA1:75499CFA62F2DA316915FADA2580122DC3318BAD
                                                                                                                                                                                                                          SHA-256:39721233855E97BFA508959B6DD91E1924456E381D36FDFC845E589D82B1B0CC
                                                                                                                                                                                                                          SHA-512:EA01D8CB36D446ACE31C5D7E50DFAE575576FD69FD5D413941EEBBA7CCC1075F6774AF3C69469CD7BAF6E1068AA5E5B4C560F550EDD2A8679124E48C55C8E8D7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# listbox.tcl --.#.# This file defines the default bindings for Tk listbox widgets.# and provides procedures that help in implementing those bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...#--------------------------------------------------------------------------.# tk::Priv elements used in this file:.#.# afterId -..Token returned by "after" for autoscanning..# listboxPrev -.The last element to be selected or deselected.#...during a selection operation..# listboxSelection -.All of the items that were selected before the.#...current selection operation (such as a mouse.#...drag) started; used to cancel an operation..#--------------------------------------------------------------------------..#-------------------------------------
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9569
                                                                                                                                                                                                                          Entropy (8bit):4.736161258754494
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:cp4NSZKF/bcaQTViJ8pox8tJRd/v0tAANQSLkROOp+4BQjBC:jSZKF/Iaarpocdn07NQS34ao
                                                                                                                                                                                                                          MD5:7176A4FE8EC3EA648854F1FC1BB2EA89
                                                                                                                                                                                                                          SHA1:28D96419585881C6222BC917EDB9A5863E7C519B
                                                                                                                                                                                                                          SHA-256:D454FC4E25D9DFC704556A689A17AA6F3D726F99592995952BC6492FC8F19F6E
                                                                                                                                                                                                                          SHA-512:8C33E1CD3490945DDC5DA0585E655A7FC78C9950886F68C096D103AE510C1024632AB3D41E9573937BB4359D365FFB8F5A10B1CA7BFBD37442F40985107C1C8D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# megawidget.tcl.#.#.Basic megawidget support classes. Experimental for any use other than.#.the ::tk::IconList megawdget, which is itself only designed for use in.#.the Unix file dialogs..#.# Copyright (c) 2009-2010 Donal K. Fellows.#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES..#..package require Tk 8.6...::oo::class create ::tk::Megawidget {. superclass ::oo::class. method unknown {w args} {..if {[string match .* $w]} {.. [self] create $w {*}$args.. return $w..}..next $w {*}$args. }. unexport new unknown. self method create {name superclasses body} {..next $name [list \...superclass ::tk::MegawidgetClass {*}$superclasses]\;$body. }.}..::oo::class create ::tk::MegawidgetClass {. variable w hull options IdleCallbacks. constructor args {..# Extract the "widget name" from the object name..set w [namespace tail [self]]...# Configure things..tclParseConfigSpec [my varname op
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):38077
                                                                                                                                                                                                                          Entropy (8bit):4.872052715667624
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:0K5IzCPGH0a9tVbQDBTo06DpSCeihpzuxdyQYEuH9DAe1:0K5i1HDE6AWuxdRYxHS8
                                                                                                                                                                                                                          MD5:181ED74919F081EEB34269500E228470
                                                                                                                                                                                                                          SHA1:953EB429F6D98562468327858ED0967BDC21B5AD
                                                                                                                                                                                                                          SHA-256:564AC0040176CC5744E3860ABC36B5FFBC648DA20B26A710DC3414EAE487299B
                                                                                                                                                                                                                          SHA-512:220E496B464575115BAF1DEDE838E70D5DDD6D199B5B8ACC1763E66D66801021B2D7CD0E1E1846868782116AD8A1F127682073D6EACD7E73F91BCED89F620109
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# menu.tcl --.#.# This file defines the default bindings for Tk menus and menubuttons..# It also implements keyboard traversal of menus and implements a few.# other utility procedures related to menus..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998-1999 by Scriptics Corporation..# Copyright (c) 2007 Daniel A. Steffen <das@users.sourceforge.net>.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# cursor -..Saves the -cursor option for the posted menubutton..# focus -..Saves the focus during a menu selection operation..#...Focus gets restored here when the menu is unposted..# grabGlobal -..Used in conjunction with tk::Priv(oldGrab): if.#...tk::Priv(oldGrab) is non-empty, then tk::Pr
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):29352
                                                                                                                                                                                                                          Entropy (8bit):5.110577585375791
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:hmie+xwcBO/SHAqFySrhkvQueYpx8DPF52qdREXXZ2/OODi:I+xwcBO/SHAqFySrhAQueYD8D95TOL
                                                                                                                                                                                                                          MD5:5F3793E7E582111C17C85E23194AEFD5
                                                                                                                                                                                                                          SHA1:925D973B70252384D1DE9B388C6C2038E646FDDF
                                                                                                                                                                                                                          SHA-256:0AC9D11D4046EF4D8E6D219F6941BF69C6AE448C6A1C2F7FC382F84B5786F660
                                                                                                                                                                                                                          SHA-512:2922546BA69232DBC205FE83EF54916E334E7AC93B7A26A208341F9C101209DA84C73F48C52BDB8E63E71A545853652B86378EBEB88F000BC16FCFB0EF5D8517
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# mkpsenc.tcl --.#.# This file generates the postscript prolog used by Tk...namespace eval ::tk {. # Creates Postscript encoding vector for ISO-8859-1 (could theoretically. # handle any 8-bit encoding, but Tk never generates characters outside. # ASCII).. #. proc CreatePostscriptEncoding {} {..variable psglyphs..# Now check for known. Even if it is known, it can be other than we..# need. GhostScript seems to be happy with such approach..set result "\[\n"..for {set i 0} {$i<256} {incr i 8} {.. for {set j 0} {$j<8} {incr j} {...set enc [encoding convertfrom "iso8859-1" \....[format %c [expr {$i+$j}]]]...catch {... set hexcode {}... set hexcode [format %04X [scan $enc %c]]...}...if {[info exists psglyphs($hexcode)]} {... append result "/$psglyphs($hexcode)"...} else {... append result "/space"...}.. }.. append result "\n"..}..append result "\]"..return $result. }.. # List of adobe glyph names. Converted from glyphlist.txt, downloaded from. # Ad
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:xbm image (32x, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16527
                                                                                                                                                                                                                          Entropy (8bit):4.679051291122852
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:aWsDPYblrrfcRcfjAwnAVDTS3ifQjvwMXEcjY:aTRcfjAwGTfQjvPXt0
                                                                                                                                                                                                                          MD5:C93F295967350F7010207874992E01A5
                                                                                                                                                                                                                          SHA1:CAE8EF749F7618326B3307DA7ED6DEBB380286DD
                                                                                                                                                                                                                          SHA-256:52C5B87C99C142D5FC77E0C22B78B7CD63A4861756FD6B39648A2E9A8EDDE953
                                                                                                                                                                                                                          SHA-512:F7E60211C0BC1ECEDE03022D622C5B9AAEAE3C203A60B6B034E1886F857C8FAD6BA6B1F7BA1EE7D733720775E7108F1BFD4C5B54A0F4919CE4EB43851D1190F8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# msgbox.tcl --.#.#.Implements messageboxes for platforms that do not have native.#.messagebox support..#.# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# Ensure existence of ::tk::dialog namespace.#.namespace eval ::tk::dialog {}..image create bitmap ::tk::dialog::b1 -foreground black \.-data "#define b1_width 32\n#define b1_height 32.static unsigned char q1_bits[] = {. 0x00, 0xf8, 0x1f, 0x00, 0x00, 0x07, 0xe0, 0x00, 0xc0, 0x00, 0x00, 0x03,. 0x20, 0x00, 0x00, 0x04, 0x10, 0x00, 0x00, 0x08, 0x08, 0x00, 0x00, 0x10,. 0x04, 0x00, 0x00, 0x20, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80,. 0x01, 0x00, 0x00, 0x80, 0x02, 0x00, 0x00, 0x40, 0x02, 0x00, 0x00, 0x40,. 0x04, 0x00, 0x00, 0x20, 0x08, 0x00,
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4158
                                                                                                                                                                                                                          Entropy (8bit):4.744283779865612
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:RC98Kz+4GgKafRXwSl51gmJnANlsgPVG5QOFWQfl5:RC98/4PGi51gmAsgPVjm5
                                                                                                                                                                                                                          MD5:EBAFA3EE899EBB06D52C204493CEE27A
                                                                                                                                                                                                                          SHA1:95E6C71E4525A8DD91E488B952665AE9C5FBDDED
                                                                                                                                                                                                                          SHA-256:D1B0FED0BEA51B3FAF08D8634034C7388BE7148F9B807460B7D185706DB8416F
                                                                                                                                                                                                                          SHA-512:ADDE3C85A7A4148BAFD6C8B8902FC8C229F1D1AAF118BE85F44E4667237E66938864E2B7B4486B7C68C89EB4559F1D8367F9F563B9C6C8BCAB66118B36E670B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset cs "&Abort" "&P\u0159eru\u0161it". ::msgcat::mcset cs "&About..." "&O programu...". ::msgcat::mcset cs "All Files" "V\u0161echny soubory". ::msgcat::mcset cs "Application Error" "Chyba programu". ::msgcat::mcset cs "Bold Italic". ::msgcat::mcset cs "&Blue" "&Modr\341". ::msgcat::mcset cs "Cancel" "Zru\u0161it". ::msgcat::mcset cs "&Cancel" "&Zru\u0161it". ::msgcat::mcset cs "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nemohu zm\u011bnit atku\341ln\355 adres\341\u0159 na \"%1\$s\".\nP\u0159\355stup odm\355tnut.". ::msgcat::mcset cs "Choose Directory" "V\375b\u011br adres\341\u0159e". ::msgcat::mcset cs "Cl&ear" "Sma&zat". ::msgcat::mcset cs "&Clear Console" "&Smazat konzolu". ::msgcat::mcset cs "Color" "Barva". ::msgcat::mcset cs "Console" "Konzole". ::msgcat::mcset cs "&Copy" "&Kop\355rovat". ::msgcat::mcset cs "Cu&t" "V&y\u0159\355znout". ::msgcat::mcset cs "&Delete" "&Smazat"
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3909
                                                                                                                                                                                                                          Entropy (8bit):4.6030170761850915
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:G8ONjSf5s80vWCUx5kTvgXTfODYE9lAUt:G8OmB0ZUx5kTv4sbt
                                                                                                                                                                                                                          MD5:C414C6972F0AAD5DFA31297919D0587F
                                                                                                                                                                                                                          SHA1:529AE0B0CB9D1DBC7F8844F346149E151DE0A36B
                                                                                                                                                                                                                          SHA-256:85E6CEE6001927376725F91EAA55D17B3D9E38643E17755A42C05FE491C63BDE
                                                                                                                                                                                                                          SHA-512:0F2A777B9C3D6C525097E19D1CC4525E9BAF78E0CABF54DD693C64BC1FD4EA75402D906A8302489997BA83ABA5AFD7CA1DE30FFE0888CD19950F56A9D38B018A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset da "&Abort" "&Afbryd". ::msgcat::mcset da "&About..." "&Om...". ::msgcat::mcset da "All Files" "Alle filer". ::msgcat::mcset da "Application Error" "Programfejl". ::msgcat::mcset da "&Blue" "&Bl\u00E5". ::msgcat::mcset da "Cancel" "Annuller". ::msgcat::mcset da "&Cancel" "&Annuller". ::msgcat::mcset da "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ikke skifte til katalog \"%1\$s\".\nIngen rettigheder.". ::msgcat::mcset da "Choose Directory" "V\u00E6lg katalog". ::msgcat::mcset da "Cl&ear" "&Ryd". ::msgcat::mcset da "&Clear Console" "&Ryd konsolen". ::msgcat::mcset da "Color" "Farve". ::msgcat::mcset da "Console" "Konsol". ::msgcat::mcset da "&Copy" "&Kopier". ::msgcat::mcset da "Cu&t" "Kli&p". ::msgcat::mcset da "&Delete" "&Slet". ::msgcat::mcset da "Details >>" "Detailer". ::msgcat::mcset da "Directory \"%1\$s\" does not exist." "Katalog \"%1\$s\" findes ikke.". ::msg
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4823
                                                                                                                                                                                                                          Entropy (8bit):4.5738552657551566
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:13LquGgagtG6vz8MFi9dDvbwKAN92qqMXg07Qt:L1/w5jwKYH1Et
                                                                                                                                                                                                                          MD5:07DF877A1166E81256273F1183B5BDC9
                                                                                                                                                                                                                          SHA1:CB455F910208E2E55B27A96ABD845FEEDA88711A
                                                                                                                                                                                                                          SHA-256:06DD7572626DF5CB0A8D3AFFBAC9BB74CB12469076836D66FD19AE5B5FAB42C7
                                                                                                                                                                                                                          SHA-512:197B09F37647D1D5130A084EA1D99D0CC16C815EC0AC31EC07875BEB2DFAE2197E2AF3E323FE8CB35F90912D76D3EB88D1E56F6E026F87AEDFADB7534BA2675A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset de "&Abort" "&Abbruch". ::msgcat::mcset de "&About..." "&\u00dcber...". ::msgcat::mcset de "All Files" "Alle Dateien". ::msgcat::mcset de "Application Error" "Applikationsfehler". ::msgcat::mcset de "&Apply" "&Anwenden". ::msgcat::mcset de "Bold" "Fett". ::msgcat::mcset de "Bold Italic" "Fett kursiv". ::msgcat::mcset de "&Blue" "&Blau". ::msgcat::mcset de "Cancel" "Abbruch". ::msgcat::mcset de "&Cancel" "&Abbruch". ::msgcat::mcset de "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kann nicht in das Verzeichnis \"%1\$s\" wechseln.\nKeine Rechte vorhanden.". ::msgcat::mcset de "Choose Directory" "W\u00e4hle Verzeichnis". ::msgcat::mcset de "Cl&ear" "&R\u00fccksetzen". ::msgcat::mcset de "&Clear Console" "&Konsole l\u00f6schen". ::msgcat::mcset de "Color" "Farbe". ::msgcat::mcset de "Console" "Konsole". ::msgcat::mcset de "&Copy" "&Kopieren". ::msgcat::mcset de "Cu&t" "Aus&schneid
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with very long lines (355)
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8698
                                                                                                                                                                                                                          Entropy (8bit):4.296709418881547
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:tCrF5o/cmSHbkI8+ETnFI3mC2hk9I+c6M30UPfMNDz91yBFkm5w+kGR8MOFiL0xu:wp5RmSHlsFerVIfM5Loam5VOMAkV
                                                                                                                                                                                                                          MD5:C802EA5388476451CD76934417761AA6
                                                                                                                                                                                                                          SHA1:25531DF6262E3B1170055735C5A874B9124FEA83
                                                                                                                                                                                                                          SHA-256:1D56D0A7C07D34BB8165CBA47FA49351B8BC5A9DB244290B9601C5885D16155C
                                                                                                                                                                                                                          SHA-512:251FABBE8B596C74BC1231823C60F5F99CF55A29212327723F5DBE604F678E8E464F2D604D1049754B7C02350712B83BCF4D9542D8167F3CAB9C9B7E5C88EC7D
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:## Messages for the Greek (Hellenic - "el") language..## Please report any changes/suggestions to:.## petasis@iit.demokritos.gr..namespace eval ::tk {. ::msgcat::mcset el "&Abort" "\u03a4\u03b5\u03c1\u03bc\u03b1\u03c4\u03b9\u03c3\u03bc\u03cc\u03c2". ::msgcat::mcset el "About..." "\u03a3\u03c7\u03b5\u03c4\u03b9\u03ba\u03ac...". ::msgcat::mcset el "All Files" "\u038c\u03bb\u03b1 \u03c4\u03b1 \u0391\u03c1\u03c7\u03b5\u03af\u03b1". ::msgcat::mcset el "Application Error" "\u039b\u03ac\u03b8\u03bf\u03c2 \u0395\u03c6\u03b1\u03c1\u03bc\u03bf\u03b3\u03ae\u03c2". ::msgcat::mcset el "&Blue" "\u039c\u03c0\u03bb\u03b5". ::msgcat::mcset el "&Cancel" "\u0391\u03ba\u03cd\u03c1\u03c9\u03c3\u03b7". ::msgcat::mcset el \."Cannot change to the directory \"%1\$s\".\nPermission denied." \."\u0394\u03b5\u03bd \u03b5\u03af\u03bd\u03b1\u03b9 \u03b4\u03c5\u03bd\u03b1\u03c4\u03ae \u03b7 \u03b1\u03bb\u03bb\u03b1\u03b3\u03ae \u03ba\u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3286
                                                                                                                                                                                                                          Entropy (8bit):4.214322279125194
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:sqHa4IUXCtvLPgyq1+1ylnJzqFtC2NAXSxFFRRTDubLorIlnB:d64I5tDPgDNnH2SXSZRRTDuPZlB
                                                                                                                                                                                                                          MD5:64725ED622DBF1CB3F00479BA84157D7
                                                                                                                                                                                                                          SHA1:575429AEABAF6640425AC1BC397B3382C1ED1122
                                                                                                                                                                                                                          SHA-256:673C76A48ADA09A154CB038534BF90E3B9C0BA5FD6B1619DB33507DE65553362
                                                                                                                                                                                                                          SHA-512:4EBDCAB20D095789BB8D94476CCFD29DEE8DFCF96F1C2030387F0521827A140E22BBB0DAD4B73EABE26D70E1642C9981BC5CBBF0045FEABB9EF98C7CDB67795E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset en "&Abort". ::msgcat::mcset en "&About...". ::msgcat::mcset en "All Files". ::msgcat::mcset en "Application Error". ::msgcat::mcset en "&Apply". ::msgcat::mcset en "Bold". ::msgcat::mcset en "Bold Italic". ::msgcat::mcset en "&Blue". ::msgcat::mcset en "Cancel". ::msgcat::mcset en "&Cancel". ::msgcat::mcset en "Cannot change to the directory \"%1\$s\".\nPermission denied.". ::msgcat::mcset en "Choose Directory". ::msgcat::mcset en "Cl&ear". ::msgcat::mcset en "&Clear Console". ::msgcat::mcset en "Color". ::msgcat::mcset en "Console". ::msgcat::mcset en "&Copy". ::msgcat::mcset en "Cu&t". ::msgcat::mcset en "&Delete". ::msgcat::mcset en "Details >>". ::msgcat::mcset en "Directory \"%1\$s\" does not exist.". ::msgcat::mcset en "&Directory:". ::msgcat::mcset en "&Edit". ::msgcat::mcset en "Effects". ::msgcat::mcset en "Error: %1\$s". ::msgcat::mcset en "E&xit". ::msgcat
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):63
                                                                                                                                                                                                                          Entropy (8bit):4.185724027617087
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:fEGp6fR1FAGoW8vMKEQXK:sooLoQO6
                                                                                                                                                                                                                          MD5:EC6A7E69AB0B8B767367DB54CC0499A8
                                                                                                                                                                                                                          SHA1:6C2D6B622429AB8C17E07C2E0F546469823ABE57
                                                                                                                                                                                                                          SHA-256:FB93D455A9D9CF3F822C968DFB273ED931E433F2494D71D6B5F8D83DDE7EACC2
                                                                                                                                                                                                                          SHA-512:72077EAB988979EB2EE292ACDB72537172A5E96B4262CE7278B76F0FEBD7E850D18221DB551D1DE3C6EB520985B5E9642936BEEB66032F920593276784525702
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset en_gb Color Colour.}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3916
                                                                                                                                                                                                                          Entropy (8bit):4.556739397782912
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:9714zhrzeU10xrFf+/eR0Mqp+cIFIXd/KcrtCcuUc6Sq4Pe:97145eFrF2GSMqgcIFIXdyAene
                                                                                                                                                                                                                          MD5:09EF4B30B49A71FD4DEA931E334896E1
                                                                                                                                                                                                                          SHA1:6C2366CE5961CFDA53259A43E087A813CEE41841
                                                                                                                                                                                                                          SHA-256:5DE113DC4CE0DF0D8C54D4812C15EC31387127BF9AFEA028D20C6A5AA8E3AB85
                                                                                                                                                                                                                          SHA-512:9DB3BB6B76B1299AE4612DF2A2872ECEE6642FC7DF971BE3A22437154AD25E81E1B1F3E1AA7A281CB3F48F8F8198A846BCB008CCFF91A9720440AFE5BAB7DE84
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset eo "&Abort" "&\u0108esigo". ::msgcat::mcset eo "&About..." "Pri...". ::msgcat::mcset eo "All Files" "\u0108ioj dosieroj". ::msgcat::mcset eo "Application Error" "Aplikoerraro". ::msgcat::mcset eo "&Blue" "&Blua". ::msgcat::mcset eo "Cancel" "Rezignu". ::msgcat::mcset eo "&Cancel" "&Rezignu". ::msgcat::mcset eo "Cannot change to the directory \"%1\$s\".\nPermission denied." "Neeble \u0109angi al dosierulon \"%1\$s\".\nVi ne rajtas tion.". ::msgcat::mcset eo "Choose Directory" "Elektu Dosierujo". ::msgcat::mcset eo "Cl&ear" "&Klaru". ::msgcat::mcset eo "&Clear Console" "&Klaru konzolon". ::msgcat::mcset eo "Color" "Farbo". ::msgcat::mcset eo "Console" "Konzolo". ::msgcat::mcset eo "&Copy" "&Kopiu". ::msgcat::mcset eo "Cu&t" "&Enpo\u015digu". ::msgcat::mcset eo "&Delete" "&Forprenu". ::msgcat::mcset eo "Details >>" "Detaloj >>". ::msgcat::mcset eo "Directory \"%1\$s\" does not exist." "La dosieruj
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3948
                                                                                                                                                                                                                          Entropy (8bit):4.486102294561867
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:vTaZD2XRgGiWXirZe0uoH02QyTaBi2DcDmQ/jY33l4TCyFv:vmZaXhFbyGB3ELjDV
                                                                                                                                                                                                                          MD5:93FFA957E3DCF851DD7EBE587A38F2D5
                                                                                                                                                                                                                          SHA1:8C3516F79FB72F32848B40091DA67C81E40FDEFE
                                                                                                                                                                                                                          SHA-256:91DC4718DC8566C36E4BCD0C292C01F467CA7661EFF601B870ABCDFE4A94ECBB
                                                                                                                                                                                                                          SHA-512:8EC7048DDFF521DE444F697EAB305777BAC24AEA37716DA4FE5374E93CEF66DDD58D535BE8FCBCD2636D623337643B1242798BB8AC7292EA2D81AE030C3A605C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset es "&Abort" "&Abortar". ::msgcat::mcset es "&About..." "&Acerca de ...". ::msgcat::mcset es "All Files" "Todos los archivos". ::msgcat::mcset es "Application Error" "Error de la aplicaci\u00f3n". ::msgcat::mcset es "&Blue" "&Azul". ::msgcat::mcset es "Cancel" "Cancelar". ::msgcat::mcset es "&Cancel" "&Cancelar". ::msgcat::mcset es "Cannot change to the directory \"%1\$s\".\nPermission denied." "No es posible acceder al directorio \"%1\$s\".\nPermiso denegado.". ::msgcat::mcset es "Choose Directory" "Elegir directorio". ::msgcat::mcset es "Cl&ear" "&Borrar". ::msgcat::mcset es "&Clear Console" "&Borrar consola". ::msgcat::mcset es "Color". ::msgcat::mcset es "Console" "Consola". ::msgcat::mcset es "&Copy" "&Copiar". ::msgcat::mcset es "Cu&t" "Cor&tar". ::msgcat::mcset es "&Delete" "&Borrar". ::msgcat::mcset es "Details >>" "Detalles >>". ::msgcat::mcset es "Directory \"%1\$s\" does not exist." "
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3805
                                                                                                                                                                                                                          Entropy (8bit):4.582498923493114
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:fiESNtfQIFBqFHjUp4KiOzbgRuhzSAEFlBGr3jd:fiESP1aVdKiHRXcN
                                                                                                                                                                                                                          MD5:9FC55235C334F6F6026D5B38AFFB9E10
                                                                                                                                                                                                                          SHA1:CAD3805900E860B9491E3EE5C2C0F52ADCA67065
                                                                                                                                                                                                                          SHA-256:0A8BBB4D1FD87BF7A90DDFA50F4724994C9CE78D1F3E91CF40C1177DB7941DC5
                                                                                                                                                                                                                          SHA-512:FBB5E72BC376DDB9F43B8C79398CA287AFAAAF8292A8CB3AF63241973B1748FD578D49075A1287DA054BA81D3ED61A723F3DE9E10855D5E85620B371D70D9BBD
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset fr "&Abort" "&Annuler". ::msgcat::mcset fr "About..." "\u00c0 propos...". ::msgcat::mcset fr "All Files" "Tous les fichiers". ::msgcat::mcset fr "Application Error" "Erreur d'application". ::msgcat::mcset fr "&Blue" "&Bleu". ::msgcat::mcset fr "Cancel" "Annuler". ::msgcat::mcset fr "&Cancel" "&Annuler". ::msgcat::mcset fr "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossible d'acc\u00e9der au r\u00e9pertoire \"%1\$s\".\nPermission refus\u00e9e.". ::msgcat::mcset fr "Choose Directory" "Choisir r\u00e9pertoire". ::msgcat::mcset fr "Cl&ear" "Effacer". ::msgcat::mcset fr "Color" "Couleur". ::msgcat::mcset fr "Console". ::msgcat::mcset fr "Copy" "Copier". ::msgcat::mcset fr "Cu&t" "Couper". ::msgcat::mcset fr "Delete" "Effacer". ::msgcat::mcset fr "Details >>" "D\u00e9tails >>". ::msgcat::mcset fr "Directory \"%1\$s\" does not exist." "Le r\u00e9pertoire \"%1\$s\" n'existe pas.".
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4600
                                                                                                                                                                                                                          Entropy (8bit):4.752507976327236
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:IYIzxGy0Kt9C81y/HSzVqUaJf9q/x5a/mETsN:IB1FCt/4vZM+EA
                                                                                                                                                                                                                          MD5:E1BA9C40A350BAD78611839A59065BF0
                                                                                                                                                                                                                          SHA1:1A148D230C9F8D748D96A79CD4E261AF264D6524
                                                                                                                                                                                                                          SHA-256:C8134EAD129E44E9C5043E1DAD81A6A900F0DE71DB3468E2603840038687F1D8
                                                                                                                                                                                                                          SHA-512:17EC7F14C708C4D8C77731C26D0CE8AF6EBAB3D1CA878FB9682F15F0546031E39EF601683832631CA329549A630F2C9A3A69B1CC6E3CC927353605834FC62CAE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset hu "&Abort" "&Megszak\u00edt\u00e1s". ::msgcat::mcset hu "&About..." "N\u00e9vjegy...". ::msgcat::mcset hu "All Files" "Minden f\u00e1jl". ::msgcat::mcset hu "Application Error" "Alkalmaz\u00e1s hiba". ::msgcat::mcset hu "&Blue" "&K\u00e9k". ::msgcat::mcset hu "Cancel" "M\u00e9gsem". ::msgcat::mcset hu "&Cancel" "M\u00e9g&sem". ::msgcat::mcset hu "Cannot change to the directory \"%1\$s\".\nPermission denied." "A k\u00f6nyvt\u00e1rv\u00e1lt\u00e1s nem siker\u00fclt: \"%1\$s\".\nHozz\u00e1f\u00e9r\u00e9s megtagadva.". ::msgcat::mcset hu "Choose Directory" "K\u00f6nyvt\u00e1r kiv\u00e1laszt\u00e1sa". ::msgcat::mcset hu "Cl&ear" "T\u00f6rl\u00e9s". ::msgcat::mcset hu "&Clear Console" "&T\u00f6rl\u00e9s Konzol". ::msgcat::mcset hu "Color" "Sz\u00edn". ::msgcat::mcset hu "Console" "Konzol". ::msgcat::mcset hu "&Copy" "&M\u00e1sol\u00e1s". ::msgcat::mcset hu "Cu&t" "&Kiv\u00e1g\u00e1s". ::msgcat::mcset hu "
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3692
                                                                                                                                                                                                                          Entropy (8bit):4.444986253861924
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:rtcxronR9zvjZ3hWsH9TYT/dllvOr80nC2dnGHc839kUqg:xcxoXBhlHiT/dlcY0HpVg
                                                                                                                                                                                                                          MD5:ADB80EC5B23FC906A1A3313A30D789E6
                                                                                                                                                                                                                          SHA1:5FB163BC1086D3366228204078F219FE4BB67CB3
                                                                                                                                                                                                                          SHA-256:9F83DD0309ED621100F3187FFCDAE50B75F5973BBE74AF550A78EF0010495DED
                                                                                                                                                                                                                          SHA-512:BA6E0C165561CDAEAB565EF1FED4087AB3B41EC3C18432C1BDA9B011E5C7C2E12F6B2CFC9F5C0CFAC1134AE53D80459D8E5B638739C61A851232047DEA7F3BA2
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset it "&Abort" "&Interrompi". ::msgcat::mcset it "&About..." "Informazioni...". ::msgcat::mcset it "All Files" "Tutti i file". ::msgcat::mcset it "Application Error" "Errore dell' applicazione". ::msgcat::mcset it "&Blue" "&Blu". ::msgcat::mcset it "Cancel" "Annulla". ::msgcat::mcset it "&Cancel" "&Annulla". ::msgcat::mcset it "Cannot change to the directory \"%1\$s\".\nPermission denied." "Impossibile accedere alla directory \"%1\$s\".\nPermesso negato.". ::msgcat::mcset it "Choose Directory" "Scegli una directory". ::msgcat::mcset it "Cl&ear" "Azzera". ::msgcat::mcset it "&Clear Console" "Azzera Console". ::msgcat::mcset it "Color" "Colore". ::msgcat::mcset it "Console". ::msgcat::mcset it "&Copy" "Copia". ::msgcat::mcset it "Cu&t" "Taglia". ::msgcat::mcset it "Delete" "Cancella". ::msgcat::mcset it "Details >>" "Dettagli >>". ::msgcat::mcset it "Directory \"%1\$s\" does not exist." "La director
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4466
                                                                                                                                                                                                                          Entropy (8bit):4.472386382725933
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:791wMjS3Md15YNISfTMEu5KIXTLLBIafWUuvfbLnZj4gT7VT4k7BLyslwI6Blb4t:DVe3MX8ISUKYuXbLnZj4MRJhjSIO4t
                                                                                                                                                                                                                          MD5:B628EAFD489335ED620014B56821B792
                                                                                                                                                                                                                          SHA1:8F6AFF68B42B747D30870D6DA7E058294921406A
                                                                                                                                                                                                                          SHA-256:D3D07AAD792C0E83F4704B304931EA549D12CBB3D99A573D9815E954A5710707
                                                                                                                                                                                                                          SHA-512:C33D097D2897D20F75A197E30B859DC83C8B4E42F260150BC7205918779D77A8C2390BE65376622F6705C38ECDF6F14B6ABAD29EDE3DE79603025BBBC39BEBC7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset nl "&Abort" "&Afbreken". ::msgcat::mcset nl "&About..." "Over...". ::msgcat::mcset nl "All Files" "Alle Bestanden". ::msgcat::mcset nl "Application Error" "Toepassingsfout". ::msgcat::mcset nl "&Apply" "Toepassen". ::msgcat::mcset nl "Bold" "Vet". ::msgcat::mcset nl "Bold Italic" "Vet Cursief". ::msgcat::mcset nl "&Blue" "&Blauw". ::msgcat::mcset nl "Cancel" "Annuleren". ::msgcat::mcset nl "&Cancel" "&Annuleren". ::msgcat::mcset nl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan niet naar map \"%1\$s\" gaan.\nU heeft hiervoor geen toestemming.". ::msgcat::mcset nl "Choose Directory" "Kies map". ::msgcat::mcset nl "Cl&ear" "Wissen". ::msgcat::mcset nl "&Clear Console" "&Wis Console". ::msgcat::mcset nl "Color" "Kleur". ::msgcat::mcset nl "Console". ::msgcat::mcset nl "&Copy" "Kopi\u00ebren". ::msgcat::mcset nl "Cu&t" "Knippen". ::msgcat::mcset nl "&Delete" "Wissen". ::
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4841
                                                                                                                                                                                                                          Entropy (8bit):4.754441208797498
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:mYpnddv1H+BBv5vVXKjB+y7ldBU63XQ3DGHolytTzEQdWaz0ybBaKG:zpdzH+3vLKnG63XdHoMpYYaL
                                                                                                                                                                                                                          MD5:17B63EFE0A99F44D27DD41C4CC0A8A7B
                                                                                                                                                                                                                          SHA1:3E45C0102B287908D770A31D1906678E785088C2
                                                                                                                                                                                                                          SHA-256:1993B4EC2DC009D2E6CA185D0BD565D3F33A4EFA79BACA39E4F97F574D63F305
                                                                                                                                                                                                                          SHA-512:F8B9E7BC76A4ED5F948A9E505F3B1A321E322DD57CF88BEF36B6A9AF793462E45432709402151B4BB520B12B089A043CA23FF86106ED7B5C73DFBB6E233907F4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset pl "&Abort" "&Przerwij". ::msgcat::mcset pl "&About..." "O programie...". ::msgcat::mcset pl "All Files" "Wszystkie pliki". ::msgcat::mcset pl "Application Error" "B\u0142\u0105d w programie". ::msgcat::mcset pl "&Apply" "Zastosuj". ::msgcat::mcset pl "Bold" "Pogrubienie". ::msgcat::mcset pl "Bold Italic" "Pogrubiona kursywa". ::msgcat::mcset pl "&Blue" "&Niebieski". ::msgcat::mcset pl "Cancel" "Anuluj". ::msgcat::mcset pl "&Cancel" "&Anuluj". ::msgcat::mcset pl "Cannot change to the directory \"%1\$s\".\nPermission denied." "Nie mo\u017cna otworzy\u0107 katalogu \"%1\$s\".\nOdmowa dost\u0119pu.". ::msgcat::mcset pl "Choose Directory" "Wybierz katalog". ::msgcat::mcset pl "Cl&ear" "&Wyczy\u015b\u0107". ::msgcat::mcset pl "&Clear Console" "&Wyczy\u015b\u0107 konsol\u0119". ::msgcat::mcset pl "Color" "Kolor". ::msgcat::mcset pl "Console" "Konsola". ::msgcat::mcset pl "&Copy" "&Kopiuj". ::msgcat::
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3913
                                                                                                                                                                                                                          Entropy (8bit):4.5841256573492135
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:k82mOQNHHouc2Ib2dxwj0Hpn4KeJ4iFHh29wDPK8+i92M5L:k82mOenox2x5Hp47mi3ZUMB
                                                                                                                                                                                                                          MD5:236356817E391D8871EA59667F47DA0C
                                                                                                                                                                                                                          SHA1:948EE95F4549DA8C7D412911D17B4B62CBA22ADD
                                                                                                                                                                                                                          SHA-256:AD0E466131D3789DE321D9D0588E19E4647BA82EDE41EEE6EBEF464786F8BDBE
                                                                                                                                                                                                                          SHA-512:3AB10D1980D4C1367EA0BB54E50709DF32A870E851EDE80F30F66DA4B09C1ACFFF4E77C462BD815DD67F485DDFF77FEBD09CA29D77EEE55FE8A00D115D600C32
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset pt "&Abort" "&Abortar". ::msgcat::mcset pt "About..." "Sobre ...". ::msgcat::mcset pt "All Files" "Todos os arquivos". ::msgcat::mcset pt "Application Error" "Erro de aplica\u00e7\u00e3o". ::msgcat::mcset pt "&Blue" "&Azul". ::msgcat::mcset pt "Cancel" "Cancelar". ::msgcat::mcset pt "&Cancel" "&Cancelar". ::msgcat::mcset pt "Cannot change to the directory \"%1\$s\".\nPermission denied." "N\u00e3o foi poss\u00edvel mudar para o diret\u00f3rio \"%1\$s\".\nPermiss\u00e3o negada.". ::msgcat::mcset pt "Choose Directory" "Escolha um diret\u00f3rio". ::msgcat::mcset pt "Cl&ear" "Apagar". ::msgcat::mcset pt "&Clear Console" "Apagar Console". ::msgcat::mcset pt "Color" "Cor". ::msgcat::mcset pt "Console". ::msgcat::mcset pt "&Copy" "Copiar". ::msgcat::mcset pt "Cu&t" "Recortar". ::msgcat::mcset pt "&Delete" "Excluir". ::msgcat::mcset pt "Details >>" "Detalhes >>". ::msgcat::mcset pt "Directory \"%1\$s\"
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7214
                                                                                                                                                                                                                          Entropy (8bit):4.358559144448363
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:ZUEBGTT4Ys7LT3xXkhF2xSrwFlOzFAn9E/j49cDRqRjGSQvN8Nfo5hgV9aWTRtaa:SraFGImk+4RKOGqRyRu
                                                                                                                                                                                                                          MD5:D7C27DBDF7B349BE13E09F35BA61A5F8
                                                                                                                                                                                                                          SHA1:40A52544B557F19736EA1767BFBF5708A9BBC318
                                                                                                                                                                                                                          SHA-256:C863DEBAB79F9682FD0D52D864E328E7333D03F4E9A75DBB342C30807EFDCFFB
                                                                                                                                                                                                                          SHA-512:DAF10336096B0574F060757CB6DD24049692F81B969B01BB8FA212035D955B8DA53F5ECDE3613E6AEF3C47165F075CC14363E4B854B2407EA452EAB4D4D31955
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset ru "&Abort" "&\u041e\u0442\u043c\u0435\u043d\u0438\u0442\u044c". ::msgcat::mcset ru "&About..." "\u041f\u0440\u043e...". ::msgcat::mcset ru "All Files" "\u0412\u0441\u0435 \u0444\u0430\u0439\u043b\u044b". ::msgcat::mcset ru "Application Error" "\u041e\u0448\u0438\u0431\u043a\u0430 \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435". ::msgcat::mcset ru "&Blue" " &\u0413\u043e\u043b\u0443\u0431\u043e\u0439". ::msgcat::mcset ru "Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "&Cancel" "\u041e\u0442&\u043c\u0435\u043d\u0430". ::msgcat::mcset ru "Cannot change to the directory \"%1\$s\".\nPermission denied." \...."\u041d\u0435 \u043c\u043e\u0433\u0443 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \"%1\$s\".\n\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u0430\u0432 \u0434\u043e\u0441\u0442\u0443\u043f\u0430".
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3832
                                                                                                                                                                                                                          Entropy (8bit):4.609382297476727
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:g4HXcfWBJdE10M4/00li6z8XIxTB2iDxypdmmZbWxOt:FXcf6H00li9IxTEbQsb7t
                                                                                                                                                                                                                          MD5:DB1712B1C1FF0E3A46F8E86FBB78AA4D
                                                                                                                                                                                                                          SHA1:28D9DB9CBEE791C09BD272D9C2A6C3DA80EB89EA
                                                                                                                                                                                                                          SHA-256:B76EBFA21BC1E937A04A04E5122BE64B5CDEE1F47C7058B71D8B923D70C3B17B
                                                                                                                                                                                                                          SHA-512:F79CD72DCD6D1B4212A5058DA5A020E8A157E72E6D84CAFB96463E76C1CED5AC367A2295EF743FDE70C9AB1CF2F4D88A4A73300DFD4F799AA3ECDA6FBF04E588
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:namespace eval ::tk {. ::msgcat::mcset sv "&Abort" "&Avsluta". ::msgcat::mcset sv "&About..." "&Om...". ::msgcat::mcset sv "All Files" "Samtliga filer". ::msgcat::mcset sv "Application Error" "Programfel". ::msgcat::mcset sv "&Blue" "&Bl\u00e5". ::msgcat::mcset sv "Cancel" "Avbryt". ::msgcat::mcset sv "&Cancel" "&Avbryt". ::msgcat::mcset sv "Cannot change to the directory \"%1\$s\".\nPermission denied." "Kan ej n\u00e5 mappen \"%1\$s\".\nSaknar r\u00e4ttigheter.". ::msgcat::mcset sv "Choose Directory" "V\u00e4lj mapp". ::msgcat::mcset sv "Cl&ear" "&Radera". ::msgcat::mcset sv "&Clear Console" "&Radera konsollen". ::msgcat::mcset sv "Color" "F\u00e4rg". ::msgcat::mcset sv "Console" "Konsoll". ::msgcat::mcset sv "&Copy" "&Kopiera". ::msgcat::mcset sv "Cu&t" "Klipp u&t". ::msgcat::mcset sv "&Delete" "&Radera". ::msgcat::mcset sv "Details >>" "Detaljer >>". ::msgcat::mcset sv "Directory \"%1\$s\" does not exist." "Mappen \"%1\$s\" finns
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5594
                                                                                                                                                                                                                          Entropy (8bit):4.9941618573215525
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:oz4CrtmsXVwM3Er4VAEQ93NZB1o+IFF5ZYi4GUoLf33yLLddzA:oUCrtmsFREEs999o7FF5ZYi4GjLfS/d2
                                                                                                                                                                                                                          MD5:7763C90F811620A6C1F0A36BAF9B89CA
                                                                                                                                                                                                                          SHA1:30E24595DD683E470FE9F12814D27D6D266B511E
                                                                                                                                                                                                                          SHA-256:F6929A5E0D18BC4C6666206C63AC4AAA66EDC4B9F456DFC083300CFA95A44BCD
                                                                                                                                                                                                                          SHA-512:2E2887392C67D05EA85DB2E6BFD4AA27779BC82D3B607A7DD221A99EFF0D2A21A6BA47A4F2D2CDFC7CFECD7E93B2B38064C4D5A51406471AE142EC9CC71F5C48
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# obsolete.tcl --.#.# This file contains obsolete procedures that people really shouldn't.# be using anymore, but which are kept around for backward compatibility..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# The procedures below are here strictly for backward compatibility with.# Tk version 3.6 and earlier. The procedures are no longer needed, so.# they are no-ops. You should not use these procedures anymore, since.# they may be removed in some future release...proc tk_menuBar args {}.proc tk_bindForTraversal args {}..# ::tk::classic::restore --.#.# Restore the pre-8.5 (Tk classic) look as the widget defaults for classic.# Tk widgets..#.# The value following an 'option add' call is the new 8.5 value..#.namespace eval ::tk::classic {. # This may need to be adjusted for some windo
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1586
                                                                                                                                                                                                                          Entropy (8bit):4.733749898743743
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:k2hguC4Zxk+Z0cIWR3afbR1EIC+KtVa+6WX13jZQl9:k6T9N3atqIkeS9FQD
                                                                                                                                                                                                                          MD5:D17FE676A057F373B44C9197114F5A69
                                                                                                                                                                                                                          SHA1:9745C83EEC8565602F8D74610424848009FFA670
                                                                                                                                                                                                                          SHA-256:76DBDBF9216678D48D1640F8FD1E278E7140482E1CAC7680127A9A425CC61DEE
                                                                                                                                                                                                                          SHA-512:FF7D9EB64D4367BB11C567E64837CB1DAAA9BE0C8A498CAD00BF63AF45C1826632BC3A09E65D6F51B26EBF2D07285802813ED55C5D697460FC95AF30A943EF8F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# optMenu.tcl --.#.# This file defines the procedure tk_optionMenu, which creates.# an option button and its associated menu..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_optionMenu --.# This procedure creates an option button named $w and an associated.# menu. Together they provide the functionality of Motif option menus:.# they can be used to select one of many values, and the current value.# appears in the global variable varName, as well as in the text of.# the option menubutton. The name of the menu is returned as the.# procedure's result, so that the caller can use it to change configuration.# options on the menu or otherwise manipulate it..#.# Arguments:.# w -...The name to use for the menubutton..# varName -..Global variable to hold the currently selected value..# first
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8174
                                                                                                                                                                                                                          Entropy (8bit):4.9180898441277705
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:ZUW5yUd51URCJWgWWWuWVWUKoDOdnAjLDlJymGH91QOW86vkQI:ZLXaCI3dFUlPdnAP69W89
                                                                                                                                                                                                                          MD5:ABE618A0891CD6909B945A2098C77D75
                                                                                                                                                                                                                          SHA1:A322CCFB33FF73E4A4730B5B21DE4290F9D94622
                                                                                                                                                                                                                          SHA-256:60B8579368BB3063F16D25F007385111E0EF8D97BB296B03656DC176E351E3CA
                                                                                                                                                                                                                          SHA-512:2DF5A50F3CA7D21F43651651879BCAE1433FF44B0A7ECE349CCF73BECC4780160125B21F69348C97DCD60503FC79A6525DB723962197E8550B42D0AE257FD8E7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# palette.tcl --.#.# This file contains procedures that change the color palette used.# by Tk..#.# Copyright (c) 1995-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk_setPalette --.# Changes the default color scheme for a Tk application by setting.# default colors in the option database and by modifying all of the.# color options for existing widgets that have the default value..#.# Arguments:.# The arguments consist of either a single color name, which.# will be used as the new background color (all other colors will.# be computed from this) or an even number of values consisting of.# option names and values. The name for an option is the one used.# for the option database, such as activeForeground, not -activeforeground...proc ::tk_setPalette {args} {. if {[winfo depth .] == 1} {..# Just return on monochrome displays, otherwise errors will occur..return. }.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5176
                                                                                                                                                                                                                          Entropy (8bit):4.933519639131517
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:PmpWHrga3awUrH6kdX3pBz6tkm71cHXYV23EmkiYlgfY8:+pWHrP36r6kJ3pBetkm6HXVUmPYlgfY8
                                                                                                                                                                                                                          MD5:2DA0A23CC9D6FD970FE00915EA39D8A2
                                                                                                                                                                                                                          SHA1:DFE3DC663C19E9A50526A513043D2393869D8F90
                                                                                                                                                                                                                          SHA-256:4ADF738B17691489C71C4B9D9A64B12961ADA8667B81856F7ADBC61DFFEADF29
                                                                                                                                                                                                                          SHA-512:B458F3D391DF9522D4E7EAE8640AF308B4209CE0D64FD490BFC0177FDE970192295C1EA7229CE36D14FC3E582C7649460B8B7B0214E0FF5629B2B430A99307D4
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# panedwindow.tcl --.#.# This file defines the default bindings for Tk panedwindow widgets and.# provides procedures that help in implementing those bindings...bind Panedwindow <Button-1> { ::tk::panedwindow::MarkSash %W %x %y 1 }.bind Panedwindow <Button-2> { ::tk::panedwindow::MarkSash %W %x %y 0 }..bind Panedwindow <B1-Motion> { ::tk::panedwindow::DragSash %W %x %y 1 }.bind Panedwindow <B2-Motion> { ::tk::panedwindow::DragSash %W %x %y 0 }..bind Panedwindow <ButtonRelease-1> {::tk::panedwindow::ReleaseSash %W 1}.bind Panedwindow <ButtonRelease-2> {::tk::panedwindow::ReleaseSash %W 0}..bind Panedwindow <Motion> { ::tk::panedwindow::Motion %W %x %y }..bind Panedwindow <Leave> { ::tk::panedwindow::Leave %W }..# Initialize namespace.namespace eval ::tk::panedwindow {}..# ::tk::panedwindow::MarkSash --.#.# Handle marking the correct sash for possible dragging.#.# Arguments:.# w..the widget.# x..widget local x coord.# y..widget local y coord.# proxy.whether this should be a prox
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):363
                                                                                                                                                                                                                          Entropy (8bit):4.977735142707899
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6:Cjtl17nOJRVxTc6ynID/cL44ncleXNyLMQ9HECJBIQ08PbDMQ9HECJBIQem8:ot7rOJdg6LYUlVfBIUjjfBIFF
                                                                                                                                                                                                                          MD5:A6448AF2C8FAFC9A4F42EACA6BF6AB2E
                                                                                                                                                                                                                          SHA1:0B295B46B6DF906E89F40A907022068BC6219302
                                                                                                                                                                                                                          SHA-256:CD44EE7F76C37C0C522BD0CFCA41C38CDEDDC74392B2191A3AF1A63D9D18888E
                                                                                                                                                                                                                          SHA-512:5B1A8CA5B09B7281DE55460D21D5195C4EE086BEBDC35FA561001181490669FFC67D261F99EAA900467FE97E980EB733C5FFBF9D8C541EDE18992BF4A435C749
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:if {[catch {package present Tcl 8.6.0}]} { return }.if {($::tcl_platform(platform) eq "unix") && ([info exists ::env(DISPLAY)]..|| ([info exists ::argv] && ("-display" in $::argv)))} {. package ifneeded Tk 8.6.9 [list load [file join $dir .. .. bin libtk8.6.dll] Tk].} else {. package ifneeded Tk 8.6.9 [list load [file join $dir .. .. bin tk86t.dll] Tk].}.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7381
                                                                                                                                                                                                                          Entropy (8bit):4.833263771361282
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:keEoaa0QfsimXZrjpgj47e5QeO9uMfUKvLAN6Zo:keEoRHsiWddgkoiUeG
                                                                                                                                                                                                                          MD5:EFC567E407C48BF2BE4E09CB18DEFC11
                                                                                                                                                                                                                          SHA1:EDEDB6776963B7D629C6ACE9440D24EB78DEA878
                                                                                                                                                                                                                          SHA-256:9708F5A1E81E1C3FEAF189020105BE28D27AA8808FF9FB2DCCA040500CF2642A
                                                                                                                                                                                                                          SHA-512:BDA5F92BD2F7B9CD29C5A732EC77A71291778A0EC3EABE81575C55DE3E207F663BA28DA4C95174045A74EFFF71B95D907C9D056BAA9E585E6F6DC14A133760BC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# safetk.tcl --.#.# Support procs to use Tk in safe interpreters..#.# Copyright (c) 1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# see safetk.n for documentation..#.#.# Note: It is now ok to let untrusted code being executed.# between the creation of the interp and the actual loading.# of Tk in that interp because the C side Tk_Init will.# now look up the master interp and ask its safe::TkInit.# for the actual parameters to use for it's initialization (if allowed),.# not relying on the slave state..#..# We use opt (optional arguments parsing).package require opt 0.4.1;..namespace eval ::safe {.. # counter for safe toplevels. variable tkSafeId 0.}..#.# tkInterpInit : prepare the slave interpreter for tk loading.# most of the real job is done by loadTk.# returns the slave name (tkInterpInit does).#.proc ::safe::tkInterpIni
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):7766
                                                                                                                                                                                                                          Entropy (8bit):4.933555104215445
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:q1xTLI9LUAp8cZIQ+Umuy9vYE2dLTaQfiwHZeABypyTtB:HUN1Umn2dKuHIpCB
                                                                                                                                                                                                                          MD5:1CE32CDAEB04C75BFCEEA5FB94B8A9F0
                                                                                                                                                                                                                          SHA1:CC7614C9EADE999963EE78B422157B7B0739894C
                                                                                                                                                                                                                          SHA-256:58C662DD3D2C653786B05AA2C88831F4E971B9105E4869D866FB6186E83ED365
                                                                                                                                                                                                                          SHA-512:1EE5A187615AE32F17936931B30FEA9551F9E3022C1F45A2BCA81624404F4E68022FCF0B03FBD61820EC6958983A8F2FBFC3AD2EC158433F8E8DE9B8FCF48476
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# scale.tcl --.#.# This file defines the default bindings for Tk scale widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1995 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for entries..#-------------------------------------------------------------------------..# Standard Motif bindings:..bind Scale <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. tk::ScaleActivate %W %x %y.}.bind Scale <Motion> {. tk::ScaleActivate %W %x %y.}.bind Scale <Leave> {. if {$tk_strictMotif} {..%W configure -activebackground $tk::Priv(activeBg). }.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12748
                                                                                                                                                                                                                          Entropy (8bit):5.026700023745507
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:AfVS+eV9fKbBevrpQQtfJMZqSwiXEfY4yhIa7yLIVNpIgdWmD3T1gFpN:Pf4wTGOfmkSwORVqaGcV4q7kpN
                                                                                                                                                                                                                          MD5:4CBFFC4E6B3F56A5890E3F7C31C6C378
                                                                                                                                                                                                                          SHA1:75DB5205B311F55D1CA1D863B8688A628BF6012A
                                                                                                                                                                                                                          SHA-256:6BA3E2D62BD4856D7D7AE87709FCAA23D81EFC38C375C6C5D91639555A84C35D
                                                                                                                                                                                                                          SHA-512:65DF7AE09E06C200A8456748DC89095BB8417253E01EC4FDAFB28A84483147DDC77AAF6B49BE9E18A326A94972086A99044BEE3CE5CF8026337DFC6972C92C04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# scrlbar.tcl --.#.# This file defines the default bindings for Tk scrollbar widgets..# It also provides procedures that help in implementing the bindings..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# The code below creates the default class bindings for scrollbars..#-------------------------------------------------------------------------..# Standard Motif bindings:.if {[tk windowingsystem] eq "x11" || [tk windowingsystem] eq "aqua"} {..bind Scrollbar <Enter> {. if {$tk_strictMotif} {..set tk::Priv(activeBg) [%W cget -activebackground]..%W configure -activebackground [%W cget -background]. }. %W activate [%W identify %x %y].}.bind Scrollbar <Motion> {. %W activate [%W identify %x %y].}..# The
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):15640
                                                                                                                                                                                                                          Entropy (8bit):5.001694129885997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:aR1yvxxVRQRrclOniQ14Yvg5bbVFMio1UF9w9P75uaMY+c6RhO1ON6Ql4qRiZ0NO:MyF5XVF61iwZ75/YRhO464z8wdEt
                                                                                                                                                                                                                          MD5:9971530F110AC2FB7D7EC91789EA2364
                                                                                                                                                                                                                          SHA1:AB553213C092EF077524ED56FC37DA29404C79A7
                                                                                                                                                                                                                          SHA-256:5D6E939B44F630A29C4FCB1E2503690C453118607FF301BEF3C07FA980D5075A
                                                                                                                                                                                                                          SHA-512:81B4CEC39B03FBECA59781AA54960F0A10A09733634F401D5553E1AAA3EBF12A110C9D555946FCDD70A9CC897514663840745241AD741DC440BB081A12DCF411
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# spinbox.tcl --.#.# This file defines the default bindings for Tk spinbox widgets and provides.# procedures that help in implementing those bindings. The spinbox builds.# off the entry widget, so it can reuse Entry bindings and procedures..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1999-2000 Jeffrey Hobbs.# Copyright (c) 2000 Ajuba Solutions.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for example,.#...start dragging out a
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):20270
                                                                                                                                                                                                                          Entropy (8bit):4.749624735829406
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:edtm3fv2ZzffGIgowSDxD7n2s7AcBnaUuFyLWFot5gzSG3k96vNTWuoJnfOvWhbk:eds3fv2ZzffGIgowSDxD7nd7AcBnahFN
                                                                                                                                                                                                                          MD5:4AD192C43972A6A4834D1D5A7C511750
                                                                                                                                                                                                                          SHA1:09CA39647AA1C14DB16014055E48A9B0237639BA
                                                                                                                                                                                                                          SHA-256:8E8ECECFD6046FE413F37A91933EEA086E31959B3FBEB127AFDD05CD9141BE9A
                                                                                                                                                                                                                          SHA-512:287FAADBC6F65FCC3EA9C1EC10B190712BB36A06D28E59F8D268EA585B4E6B13494BA111DFF6AC2EBF998578999C9C36965C714510FC21A9ACB65FF9B75097CB
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Tcl autoload index file, version 2.0.# This file is generated by the "auto_mkindex" command.# and sourced to set up indexing information for one or.# more commands. Typically each line is a command that.# sets an element in the auto_index array, where the.# element name is the name of a command and the value is.# a script that loads the command...set auto_index(::tk::dialog::error::Return) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Details) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::SaveToLog) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::Destroy) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::dialog::error::bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(bgerror) [list source [file join $dir bgerror.tcl]].set auto_index(::tk::ButtonInvoke) [list source [file join $dir button.tcl]].set auto_index(::tk::ButtonAutoInvoke) [list source [file join
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5142
                                                                                                                                                                                                                          Entropy (8bit):4.672280480827932
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:MgPXEnPQcTtD7zxeHK7ijhgdhAhbbjymL/KK2pLQY4QYNHL43EwzS6ejW:MgPUnPtTtFeqmjhgdhIbbjymL/KKeLQW
                                                                                                                                                                                                                          MD5:214FA0731A27E33826F2303750B64784
                                                                                                                                                                                                                          SHA1:C2DA41761FB7BAE38DDDEFA22AB57B337F54F5D8
                                                                                                                                                                                                                          SHA-256:FB6B35ECB1438BB8A2D816B86FB0C55500C6EA8D24AECB359CC3C7D3B3C54DE0
                                                                                                                                                                                                                          SHA-512:2E2A2412CBB090C0728333480B0E07C85087ED932974A235D5BC8C9725DE937520205D988872E1B5BEFA1E80201E046C500BC875A5CBD584A5099930EBBD115A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tearoff.tcl --.#.# This file contains procedures that implement tear-off menus..#.# Copyright (c) 1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..# ::tk::TearoffMenu --.# Given the name of a menu, this procedure creates a torn-off menu.# that is identical to the given menu (including nested submenus)..# The new torn-off menu exists as a toplevel window managed by the.# window manager. The return value is the name of the new menu..# The window is created at the point specified by x and y.#.# Arguments:.# w -...The menu to be torn-off (duplicated)..# x -...x coordinate where window is created.# y -...y coordinate where window is created..proc ::tk::TearOffMenu {w {x 0} {y 0}} {. # Find a unique name to use for the torn-off menu. Find the first. # ancestor of w that is a toplevel but not a menu,
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):33155
                                                                                                                                                                                                                          Entropy (8bit):4.908284262811967
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:ThZXGSuWlNGbyBFFRzGagUNKEFx8wredkG/gVVFaO/9bembFWaHnla98ffRiqiPp:TYaNGKF6uNdyO4Ona98ffRUAlde
                                                                                                                                                                                                                          MD5:03CC27E28E0CFCE1B003C3E936797AB0
                                                                                                                                                                                                                          SHA1:C7FE5AE7F35C86EC3724F6A111EAAF2C1A18ABE9
                                                                                                                                                                                                                          SHA-256:BCCC1039F0EB331C4BB6BD5848051BB745F242016952723478C93B009F63D254
                                                                                                                                                                                                                          SHA-512:5091B10EE8446E6853EF7060EC13AB8CADA0D6448F9081FEBD07546C061F69FC273BBF23BA7AF05D8359E618DD68A5C27F0453480FE3F26E744DB19BFCD115C7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# text.tcl --.#.# This file defines the default bindings for Tk text widgets and provides.# procedures that help in implementing the bindings..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 1998 by Scriptics Corporation..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..#-------------------------------------------------------------------------.# Elements of ::tk::Priv that are used in this file:.#.# afterId -..If non-null, it means that auto-scanning is underway.#...and it gives the "after" id for the next auto-scan.#...command to be executed..# char -..Character position on the line; kept in order.#...to allow moving up or down past short lines while.#...still remembering the desired position..# mouseMoved -..Non-zero means the mouse has moved a significant.#...amount since the button went down (so, for exampl
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:Tcl script, ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):23142
                                                                                                                                                                                                                          Entropy (8bit):5.097142507145225
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:dmAlIQ7ylH462gngqeObubqLwvoGah0QSA4jLGn3WB0MCdPAWD+g190K5TzMSW4d:dmOIQulHokh0QzMemB0MCD+g1bk+
                                                                                                                                                                                                                          MD5:3250EC5B2EFE5BBE4D3EC271F94E5359
                                                                                                                                                                                                                          SHA1:6A0FE910041C8DF4F3CDC19871813792E8CC4E4C
                                                                                                                                                                                                                          SHA-256:E1067A0668DEBB2D8E8EC3B7BC1AEC3723627649832B20333F9369F28E4DFDBF
                                                                                                                                                                                                                          SHA-512:F8E403F3D59D44333BCE2AA7917E6D8115BEC0FE5AE9A1306F215018B05056467643B7AA228154DDCED176072BC903DFB556CB2638F5C55C1285C376079E8FE3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tk.tcl --.#.# Initialization script normally executed in the interpreter for each Tk-based.# application. Arranges class bindings for widgets..#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Ajuba Solutions..#.# See the file "license.terms" for information on usage and redistribution of.# this file, and for a DISCLAIMER OF ALL WARRANTIES...# Verify that we have Tk binary and script components from the same release.package require -exact Tk 8.6.9...# Create a ::tk namespace.namespace eval ::tk {. # Set up the msgcat commands. namespace eval msgcat {..namespace export mc mcmax. if {[interp issafe] || [catch {package require msgcat}]} {. # The msgcat package is not available. Supply our own. # minimal replacement.. proc mc {src args} {. return [format $src {*}$args]. }. proc mcmax {args} {.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):38373
                                                                                                                                                                                                                          Entropy (8bit):5.143151103117394
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:a6NFLvIIaE2wCpxQYt/rJTkA3NN5YAGnk1c6gHZZgkO0Z6INfdpsaUpWz8ZlhL5S:akJ2wKFXuNzClMGH87f12Vb4
                                                                                                                                                                                                                          MD5:21985684C432CB918A3E862517842F75
                                                                                                                                                                                                                          SHA1:4DBACAEEF8454C1B08993D76857C5F09AA75405A
                                                                                                                                                                                                                          SHA-256:AE448DF6FDBBA45D450ABEFEF12799F8362177B0B9FE06F3CA3CB0EDA5E6AA58
                                                                                                                                                                                                                          SHA-512:AFEA6C47001455D7E40A5A7728FA4DFAD7BB66B02191E807BB15355847F5B265DEEE6015516807B10E1273710A3D03FAAC7856CB16EFA773813105B23A11960F
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# tkfbox.tcl --.#.#.Implements the "TK" standard file selection dialog box. This dialog.#.box is used on the Unix platforms whenever the tk_strictMotif flag is.#.not set..#.#.The "TK" standard file selection dialog box is similar to the file.#.selection dialog box on Win95(TM). The user can navigate the.#.directories by clicking on the folder icons or by selecting the.#."Directory" option menu. The user can select files by clicking on the.#.file icons or by entering a filename in the "Filename:" entry..#.# Copyright (c) 1994-1998 Sun Microsystems, Inc..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {. namespace import -force ::tk::msgcat::*. variable showHiddenBtn 0. variable showHiddenVar 1.. # Create the images if they did not already exist.. if {![info exists ::tk::Priv(updirImage)]} {..set ::tk::Priv(updirImage)
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3683
                                                                                                                                                                                                                          Entropy (8bit):4.872530668776095
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:xICsIX5RupDdMrwuQb8BQEQWQEQK9FVGQJFVGDusxzUFIG0usf2kGKQH+n5dvW8m:h7oFAzfphta9DwuTa
                                                                                                                                                                                                                          MD5:8FF9D357AF3806D997BB8654E95F530C
                                                                                                                                                                                                                          SHA1:62292163299CC229031BB4EAFBE900323056561A
                                                                                                                                                                                                                          SHA-256:E36864B33D7C2B47FE26646377BE86FB341BBF2B6DF13E33BD799E87D24FC193
                                                                                                                                                                                                                          SHA-512:ECDC47E7D1F0F9C0C052ACA2EB2DE10E78B2256E8DB85D7B52F365C1074A4E24CDB1C7A2780B36DFA36F174FF87B6A31C49F61CC0AC3D2412B3915234D911C9C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Ttk widget set: Alternate theme.#..namespace eval ttk::theme::alt {.. variable colors. array set colors {..-frame .."#d9d9d9"..-window.."#ffffff"..-darker ."#c3c3c3"..-border.."#414141"..-activebg ."#ececec"..-disabledfg."#a3a3a3"..-selectbg."#4a6984"..-selectfg."#ffffff"..-altindicator."#aaaaaa". }.. ttk::style theme settings alt {...ttk::style configure "." \.. -background .$colors(-frame) \.. -foreground .black \.. -troughcolor.$colors(-darker) \.. -bordercolor.$colors(-border) \.. -selectbackground .$colors(-selectbg) \.. -selectforeground .$colors(-selectfg) \.. -font ..TkDefaultFont \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)] ;..ttk::style map "." -foreground [list disabled $colors(-disabledfg)] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -padding "1 1" \.. -relief raised -shiftrelief 1 \.. -highl
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2245
                                                                                                                                                                                                                          Entropy (8bit):4.988082031411997
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:tdlBlblITKleKgNX1gPc+JFzVPb9ZLJY2ZL7X0jX4:p51gRK7F9DzrMo
                                                                                                                                                                                                                          MD5:6466DBA5F7DDB28F280A24E2397DD875
                                                                                                                                                                                                                          SHA1:060C504D08B014EB388EFAF48E3720CE5D7F0132
                                                                                                                                                                                                                          SHA-256:CBC17D1C434CACD0AB42CDCC4D62ED193F926447189AD258C13738D4EC154A80
                                                                                                                                                                                                                          SHA-512:5FAAC1C5FC868DCE8B7A9431BEAEB8117ADDE5C752306CAD7B6FA8123758F2CF37FB1CF18CAC2934F7D07B14FAFCE01581BAD0CA952BFECFCBD9E1E26FF9A64C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Aqua theme (OSX native look and feel).#..namespace eval ttk::theme::aqua {. ttk::style theme settings aqua {...ttk::style configure . \.. -font TkDefaultFont \.. -background systemWindowBody \.. -foreground systemModelessDialogActiveText \.. -selectbackground systemHighlight \.. -selectforeground systemModelessDialogActiveText \.. -selectborderwidth 0 \.. -insertwidth 1...ttk::style map . \.. -foreground {disabled systemModelessDialogInactiveText... background systemModelessDialogInactiveText} \.. -selectbackground {background systemHighlightSecondary... !focus systemHighlightSecondary} \.. -selectforeground {background systemModelessDialogInactiveText... !focus systemDialogActiveText}...# Workaround for #1100117:..# Actually, on Aqua we probably shouldn't stipple images in..# disabled buttons even if it did work.....ttk::style configure . -stipple {}...ttk::style configure TButton -anchor center -width -6..ttk::style configure Toolbutton -
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2978
                                                                                                                                                                                                                          Entropy (8bit):4.8919006418640265
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:hpNRZ/rtWkRMC0ScGHsAEfKPi7K1MFNQ6z4Dvh8niT6CUI+SfRHThp:DNRZzse1cGH3UvKmFNQ6z2hT6CUI+4Hb
                                                                                                                                                                                                                          MD5:EA7CF40852AFD55FFDA9DB29A0E11322
                                                                                                                                                                                                                          SHA1:B7B42FAC93E250B54EB76D95048AC3132B10E6D8
                                                                                                                                                                                                                          SHA-256:391B6E333D16497C4B538A7BDB5B16EF11359B6E3B508D470C6E3703488E3B4D
                                                                                                                                                                                                                          SHA-512:123D78D6AC34AF4833D05814220757DCCF2A9AF4761FE67A8FE5F67A0D258B3C8D86ED346176FFB936AB3717CFD75B4FAB7373F7853D44FA356BE6E3A75E51B9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Bindings for Buttons, Checkbuttons, and Radiobuttons..#.# Notes: <Button1-Leave>, <Button1-Enter> only control the "pressed".# state; widgets remain "active" if the pointer is dragged out..# This doesn't seem to be conventional, but it's a nice way.# to provide extra feedback while the grab is active..# (If the button is released off the widget, the grab deactivates and.# we get a <Leave> event then, which turns off the "active" state).#.# Normally, <ButtonRelease> and <ButtonN-Enter/Leave> events are .# delivered to the widget which received the initial <ButtonPress>.# event. However, Tk [grab]s (#1223103) and menu interactions.# (#1222605) can interfere with this. To guard against spurious.# <Button1-Enter> events, the <Button1-Enter> binding only sets.# the pressed state if the button is currently active..#..namespace eval ttk::button {}..bind TButton <Enter> ..{ %W instate !disabled {%W state active} }.bind TButton <Leave>..{ %W state !active }.bind TButton <Key-space>.{ ttk:
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4742
                                                                                                                                                                                                                          Entropy (8bit):4.859511673200619
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:9zDTlU3tCKW3PiAu4UZQsk+EBSucCtCqM368CtTU/+xgxaYgxaf/sY2+rF5usxzk:ZuHjO7uCkqM3JCNU/igxNgxor2tpuTM
                                                                                                                                                                                                                          MD5:AA2987DC061DAA998B73A1AD937EE4BB
                                                                                                                                                                                                                          SHA1:33FE9DFA76FB08B9D8D5C3554D13482D330C2DB1
                                                                                                                                                                                                                          SHA-256:4ED0ACDD29FC1FB45C6BDC9EFB2CBADE34B93C45D5DBB269A4A4A3044CF4CB7A
                                                                                                                                                                                                                          SHA-512:5A83B1FC88E42BB1DAD60D89CD5F2193E6AB59C4902A6C727E0090D1F395C2F122521FDFF250A14109EE5113D5034319199FB260129416EA962559350F217A03
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# "Clam" theme..#.# Inspired by the XFCE family of Gnome themes..#..namespace eval ttk::theme::clam {. variable colors . array set colors {..-disabledfg.."#999999"..-frame .."#dcdad5"..-window .."#ffffff"..-dark..."#cfcdc8"..-darker .."#bab5ab"..-darkest.."#9e9a91"..-lighter.."#eeebe7"..-lightest .."#ffffff"..-selectbg.."#4a6984"..-selectfg.."#ffffff"..-altindicator.."#5895bc"..-disabledaltindicator."#a0a0a0". }.. ttk::style theme settings clam {...ttk::style configure "." \.. -background $colors(-frame) \.. -foreground black \.. -bordercolor $colors(-darkest) \.. -darkcolor $colors(-dark) \.. -lightcolor $colors(-lighter) \.. -troughcolor $colors(-darker) \.. -selectbackground $colors(-selectbg) \.. -selectforeground $colors(-selectfg) \.. -selectborderwidth 0 \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -background [list disabled $colors(-frame) \.... active $colors(-lighter)] \.. -foreground [list disabled $colors(
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3828
                                                                                                                                                                                                                          Entropy (8bit):4.892728136244756
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:yAJZjsTMw96Ey6kvzuVuby+x0M+x06uxjFVGQJFVGQuxzUFIGQutK2MRvD7J+iSz:yAJZ8MVJiVR+x/+xefVItuTy7Urt
                                                                                                                                                                                                                          MD5:7DBF35F3F0F9FB68626019FF94EFBCD3
                                                                                                                                                                                                                          SHA1:213F18224BF0573744836CD3BEDC83D5E443A406
                                                                                                                                                                                                                          SHA-256:30E6766E9B8292793395324E412B0F5A8888512B84B080E247F95BF6EFB11A9D
                                                                                                                                                                                                                          SHA-512:9081E5C89ECDE8337C5A52531DEF24924C0BCB3A1F0596D3B986CC59E635F67A78327ABF26209BF71A9BA370A93174298E6ABD11586382D7D70ADEA7E5CCF854
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# "classic" Tk theme..#.# Implements Tk's traditional Motif-like look and feel..#..namespace eval ttk::theme::classic {.. variable colors; array set colors {..-frame.."#d9d9d9"..-window.."#ffffff"..-activebg."#ececec"..-troughbg."#c3c3c3"..-selectbg."#c3c3c3"..-selectfg."#000000"..-disabledfg."#a3a3a3"..-indicator."#b03060"..-altindicator."#b05e5e". }.. ttk::style theme settings classic {..ttk::style configure "." \.. -font..TkDefaultFont \.. -background..$colors(-frame) \.. -foreground..black \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -troughcolor.$colors(-troughbg) \.. -indicatorcolor.$colors(-frame) \.. -highlightcolor.$colors(-frame) \.. -highlightthickness.1 \.. -selectborderwidth.1 \.. -insertwidth.2 \.. ;...# To match pre-Xft X11 appearance, use:..#.ttk::style configure . -font {Helvetica 12 bold}...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activeb
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):12493
                                                                                                                                                                                                                          Entropy (8bit):5.024195855137721
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:l/9k9hqpFXQN9uK5Bt3NvnIW+KYNbrulkL90t98VrQETczIT9QeSaQjJI1/P0lcx:BhllSBtVL5MmI0K
                                                                                                                                                                                                                          MD5:FBCAA6A08D9830114248F91E10D4C918
                                                                                                                                                                                                                          SHA1:FA63C94824BEBD3531086816650D3F3FA73FE434
                                                                                                                                                                                                                          SHA-256:9D80AA9701E82862467684D3DFF1A9EC5BBC2BBBA4F4F070518BBDE7E38499BB
                                                                                                                                                                                                                          SHA-512:B377C31CC9137851679CBA0560EFE4265792D1576BD781DD42C22014A7A8F3D10D9D48A1154BB88A2987197594C8B728B71FA689CE1B32928F8513796A6A0AA3
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Combobox bindings..#.# <<NOTE-WM-TRANSIENT>>:.#.#.Need to set [wm transient] just before mapping the popdown.#.instead of when it's created, in case a containing frame.#.has been reparented [#1818441]..#.#.On Windows: setting [wm transient] prevents the parent.#.toplevel from becoming inactive when the popdown is posted.#.(Tk 8.4.8+).#.#.On X11: WM_TRANSIENT_FOR on override-redirect windows.#.may be used by compositing managers and by EWMH-aware.#.window managers (even though the older ICCCM spec says.#.it's meaningless)..#.#.On OSX: [wm transient] does utterly the wrong thing..#.Instead, we use [MacWindowStyle "help" "noActivates hideOnSuspend"]..#.The "noActivates" attribute prevents the parent toplevel.#.from deactivating when the popdown is posted, and is also.#.necessary for "help" windows to receive mouse events..#."hideOnSuspend" makes the popdown disappear (resp. reappear).#.when the parent toplevel is deactivated (resp. reactivated)..#.(see [#1814778]). Also set [wm resiz
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4007
                                                                                                                                                                                                                          Entropy (8bit):4.827479665184231
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:xtIni2E1nmuVoLlTxG6qVXvDiPOaCkhxKLbqnJ2RLWumgMJVZlZPDjsfMh8vIviX:sn+myoLBxG3laOqJlZT3rkdSVOJm0
                                                                                                                                                                                                                          MD5:74596004DFDBF2ECF6AF9C851156415D
                                                                                                                                                                                                                          SHA1:933318C992B705BF9F8511621B4458ECB8772788
                                                                                                                                                                                                                          SHA-256:7BDFFA1C2692C5D1CF67B518F9ACB32FA4B4D9936ED076F4DB835943BC1A00D6
                                                                                                                                                                                                                          SHA-512:0D600B21DB67BF9DADBDD49559573078EFB41E473E94124AC4D2551BC10EC764846DC1F7674DAA79F8D2A8AEB4CA27A5E11C2F30EDE47E3ECEE77D60D7842262
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Map symbolic cursor names to platform-appropriate cursors..#.# The following cursors are defined:.#.#.standard.-- default cursor for most controls.#.""..-- inherit cursor from parent window.#.none..-- no cursor.#.#.text..-- editable widgets (entry, text).#.link..-- hyperlinks within text.#.crosshair.-- graphic selection, fine control.#.busy..-- operation in progress.#.forbidden.-- action not allowed.#.#.hresize..-- horizontal resizing.#.vresize..-- vertical resizing.#.# Also resize cursors for each of the compass points,.# {nw,n,ne,w,e,sw,s,se}resize..#.# Platform notes:.#.# Windows doesn't distinguish resizing at the 8 compass points,.# only horizontal, vertical, and the two diagonals..#.# OSX doesn't have resize cursors for nw, ne, sw, or se corners..# We use the Tk-defined X11 fallbacks for these..#.# X11 doesn't have a "forbidden" cursor (usually a slashed circle);.# "pirate" seems to be the conventional cursor for this purpose..#.# Windows has an IDC_HELP cursor, but it's not
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4490
                                                                                                                                                                                                                          Entropy (8bit):4.888203318286333
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:AMUoi/higxS4JAigxS4J/1+tDtj/9uTaf30QOdt:AMUoQhigQ42igQ4kFMY3n0t
                                                                                                                                                                                                                          MD5:0E03292F7678540CB4F3440859863B0C
                                                                                                                                                                                                                          SHA1:909849894B02F2C213BDE0FBCED8C1378EB9B81E
                                                                                                                                                                                                                          SHA-256:304FF31FC82F6086C93AAA594D83D8DA25866CE1C2AF1208F9E7585D74CA9A51
                                                                                                                                                                                                                          SHA-512:87E5D2484E5E7E3C00B319219028B012576B7D73B84A9A13ED15551C9431BF216C0B96376AE5A7070B5A391D9887E55ABF9FA4AFEE971177408B7969363D9302
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Settings for default theme..#..namespace eval ttk::theme::default {. variable colors. array set colors {..-frame..."#d9d9d9"..-foreground.."#000000"..-window..."#ffffff"..-text .."#000000"..-activebg.."#ececec"..-selectbg.."#4a6984"..-selectfg.."#ffffff"..-darker .."#c3c3c3"..-disabledfg.."#a3a3a3"..-indicator.."#4a6984"..-disabledindicator."#a3a3a3"..-altindicator.."#9fbdd8"..-disabledaltindicator."#c0c0c0". }.. ttk::style theme settings default {...ttk::style configure "." \.. -borderwidth .1 \.. -background .$colors(-frame) \.. -foreground .$colors(-foreground) \.. -troughcolor .$colors(-darker) \.. -font ..TkDefaultFont \.. -selectborderwidth.1 \.. -selectbackground.$colors(-selectbg) \.. -selectforeground.$colors(-selectfg) \.. -insertwidth .1 \.. -indicatordiameter.10 \.. ;...ttk::style map "." -background \.. [list disabled $colors(-frame) active $colors(-activebg)]..ttk::style map "." -foreground \.. [list disabled $colo
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):16408
                                                                                                                                                                                                                          Entropy (8bit):4.974125903666712
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:hRy3ALQksU0oayTUXIQzNiQ2iEL8QmOhQVqknFoTOXyJtcC1JMuZm4FZxO252ExD:GoUXmiEyOFWiTOEtcC1q252Ezp
                                                                                                                                                                                                                          MD5:F9B29AB14304F18E32821A29233BE816
                                                                                                                                                                                                                          SHA1:6D0253274D777E081FA36CC38E51C2ABB9259D0E
                                                                                                                                                                                                                          SHA-256:62D1DF52C510A83103BADAB4F3A77ABB1AA3A0E1E21F68ECE0CECCA2CA2F1341
                                                                                                                                                                                                                          SHA-512:698DB665E29B29864F9FE65934CCA83A5092D81D5130FFD1EAC68C51327AE9EBC007A60A60E1AF37063017E448CE84A4024D4A412990A1078287B605DF344C70
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# DERIVED FROM: tk/library/entry.tcl r1.22.#.# Copyright (c) 1992-1994 The Regents of the University of California..# Copyright (c) 1994-1997 Sun Microsystems, Inc..# Copyright (c) 2004, Joe English.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES..#..namespace eval ttk {. namespace eval entry {..variable State...set State(x) 0..set State(selectMode) none..set State(anchor) 0..set State(scanX) 0..set State(scanIndex) 0..set State(scanMoved) 0...# Button-2 scan speed is (scanNum/scanDen) characters..# per pixel of mouse movement...# The standard Tk entry widget uses the equivalent of..# scanNum = 10, scanDen = average character width...# I don't know why that was chosen...#..set State(scanNum) 1..set State(scanDen) 1..set State(deadband) 3.;# #pixels for mouse-moved deadband.. }.}..### Option database settings..#.option add *TEntry.cursor [ttk::cursor text] widgetDefault..### Bindings..#.# Removed
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5576
                                                                                                                                                                                                                          Entropy (8bit):4.956417003071239
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:Nduphbitcq1Zs/ZrBiZy227IhLkdhetOstWGbRafkeHH+4:3CheHvsbiZyDmJbRa3+4
                                                                                                                                                                                                                          MD5:7017B5C1D53F341F703322A40C76C925
                                                                                                                                                                                                                          SHA1:57540C56C92CC86F94B47830A00C29F826DEF28E
                                                                                                                                                                                                                          SHA-256:0EB518251FBE9CF0C9451CC1FEF6BB6AEE16D62DA00B0050C83566DA053F68D0
                                                                                                                                                                                                                          SHA-512:FD18976A8FBB7E59B12944C2628DBD66D463B2F7342661C8F67160DF37A393FA3C0CE7FDDA31073674B7A46E0A0A7D0A7B29EBE0D9488AFD9EF8B3A39410B5A8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Font specifications..#.# This file, [source]d at initialization time, sets up the following.# symbolic fonts based on the current platform:.#.# TkDefaultFont.-- default for GUI items not otherwise specified.# TkTextFont.-- font for user text (entry, listbox, others).# TkFixedFont.-- standard fixed width font.# TkHeadingFont.-- headings (column headings, etc).# TkCaptionFont -- dialog captions (primary text in alert dialogs, etc.).# TkTooltipFont.-- font to use for tooltip windows.# TkIconFont.-- font to use for icon captions.# TkMenuFont.-- used to use for menu items.#.# In Tk 8.5, some of these fonts may be provided by the TIP#145 implementation.# (On Windows and Mac OS X as of Oct 2007)..#.# +++ Platform notes:.#.# Windows:.#.The default system font changed from "MS Sans Serif" to "Tahoma".# .in Windows XP/Windows 2000..#.#.MS documentation says to use "Tahoma 8" in Windows 2000/XP,.#.although many MS programs still use "MS Sans Serif 8".#.#.Should use SystemParametersInfo() inst
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4913
                                                                                                                                                                                                                          Entropy (8bit):4.841521491900473
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:1reigApQy38gaQJy+3nN+PN8JdNhtOPqoK4J+wQCV7EkGxIaqc9ld9qtlWnITOZI:hfbJvnN+PN8JdNHs64J+wQCPGxtqWrqf
                                                                                                                                                                                                                          MD5:DB24841643CEBD38D5FFD1D42B42E7F4
                                                                                                                                                                                                                          SHA1:E394AF7FAF83FAD863C7B13D855FCF3705C4F1C7
                                                                                                                                                                                                                          SHA-256:81B0B7818843E293C55FF541BD95168DB51FE760941D32C7CDE9A521BB42E956
                                                                                                                                                                                                                          SHA-512:380272D003D5F90C13571952D0C73F5FCE2A22330F98F29707F3D5BFC29C99D9BF11A947CF2CA64CF7B8DF5E4AFE56FFA00F9455BB30D15611FC5C86130346BE
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Bindings for Menubuttons..#.# Menubuttons have three interaction modes:.#.# Pulldown: Press menubutton, drag over menu, release to activate menu entry.# Popdown: Click menubutton to post menu.# Keyboard: <Key-space> or accelerator key to post menu.#.# (In addition, when menu system is active, "dropdown" -- menu posts.# on mouse-over. Ttk menubuttons don't implement this)..#.# For keyboard and popdown mode, we hand off to tk_popup and let .# the built-in Tk bindings handle the rest of the interaction..#.# ON X11:.#.# Standard Tk menubuttons use a global grab on the menubutton..# This won't work for Ttk menubuttons in pulldown mode,.# since we need to process the final <ButtonRelease> event,.# and this might be delivered to the menu. So instead we.# rely on the passive grab that occurs on <ButtonPress> events,.# and transition to popdown mode when the mouse is released.# or dragged outside the menubutton..# .# ON WINDOWS:.#.# I'm not sure what the hell is going on here. [$menu pos
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):5619
                                                                                                                                                                                                                          Entropy (8bit):4.937953914483602
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:d4tDJf49tzG809fhQAKWCgQOK/6PF+hEi8YYFSL+3FJVCj0QlK2kfJcQIni:d4tktzwfWngQOK/6PF+hDDYFNJVCj0Q2
                                                                                                                                                                                                                          MD5:82C9DFC512E143DDA78F91436937D4DD
                                                                                                                                                                                                                          SHA1:26ABC23C1E0C201A217E3CEA7A164171418973B0
                                                                                                                                                                                                                          SHA-256:D1E5267CDE3D7BE408B4C94220F7E1833C9D452BB9BA3E194E12A5EB2F9ADB80
                                                                                                                                                                                                                          SHA-512:A9D3C04AD67E0DC3F1C12F9E21EF28A61FA84DBF710313D4CA656BDF35DFBBFBA9C268C018004C1F5614DB3A1128025D795BC14B4FFFAA5603A5313199798D04
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Bindings for TNotebook widget.#..namespace eval ttk::notebook {. variable TLNotebooks ;# See enableTraversal.}..bind TNotebook <ButtonPress-1>..{ ttk::notebook::Press %W %x %y }.bind TNotebook <Key-Right>..{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Key-Left>..{ ttk::notebook::CycleTab %W -1; break }.bind TNotebook <Control-Key-Tab>.{ ttk::notebook::CycleTab %W 1; break }.bind TNotebook <Control-Shift-Key-Tab>.{ ttk::notebook::CycleTab %W -1; break }.catch {.bind TNotebook <Control-ISO_Left_Tab>.{ ttk::notebook::CycleTab %W -1; break }.}.bind TNotebook <Destroy>..{ ttk::notebook::Cleanup %W }..# ActivateTab $nb $tab --.#.Select the specified tab and set focus..#.# Desired behavior:.#.+ take focus when reselecting the currently-selected tab;.#.+ keep focus if the notebook already has it;.#.+ otherwise set focus to the first traversable widget.#. in the newly-selected tab;.#.+ do not leave the focus in a deselected tab..#.proc ttk::notebook::ActivateTab {w tab} {.
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1920
                                                                                                                                                                                                                          Entropy (8bit):4.916119835701688
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:kfkVpfktNZz51kfkB6fkO/cfkyk2fkI4fkI1fkxUufkYfkEtNMiyHvyPHfk9tNZ5:0ZPhMiyHvyPQZNtiisZvUriZPaa+fdl
                                                                                                                                                                                                                          MD5:A12915FA5CAF93E23518E9011200F5A4
                                                                                                                                                                                                                          SHA1:A61F665A408C10419FB81001578D99B43D048720
                                                                                                                                                                                                                          SHA-256:CE0053D637B580170938CF552B29AE890559B98EB28038C2F0A23A265DDEB273
                                                                                                                                                                                                                          SHA-512:669E1D66F1223CCA6CEB120914D5D876BD3CF401EE4A46F35825361076F19C7341695596A7DBB00D6CFF4624666FB4E7A2D8E7108C3C56A12BDA7B04E99E6F9A
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Bindings for ttk::panedwindow widget..#..namespace eval ttk::panedwindow {. variable State. array set State {..pressed 0. .pressX.-..pressY.-..sash .-..sashPos -. }.}..## Bindings:.#.bind TPanedwindow <ButtonPress-1> .{ ttk::panedwindow::Press %W %x %y }.bind TPanedwindow <B1-Motion>..{ ttk::panedwindow::Drag %W %x %y }.bind TPanedwindow <ButtonRelease-1> .{ ttk::panedwindow::Release %W %x %y }..bind TPanedwindow <Motion> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Enter> ..{ ttk::panedwindow::SetCursor %W %x %y }.bind TPanedwindow <Leave> ..{ ttk::panedwindow::ResetCursor %W }.# See <<NOTE-PW-LEAVE-NOTIFYINFERIOR>>.bind TPanedwindow <<EnteredChild>>.{ ttk::panedwindow::ResetCursor %W }..## Sash movement:.#.proc ttk::panedwindow::Press {w x y} {. variable State.. set sash [$w identify $x $y]. if {$sash eq ""} {. .set State(pressed) 0..return. }. set State(pressed) .1. set State(pressX) .$x. set State(pressY) .$y. set State(sa
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1089
                                                                                                                                                                                                                          Entropy (8bit):4.7101709883442755
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:24:o83oOUyNSiBj0oNA7h5EwIa2s0ImxamrNlUImyJDirNPpwWgJ:oMtS6j0eyEw0s02mhlU4khPp4J
                                                                                                                                                                                                                          MD5:B0074341A4BDA36BCDFF3EBCAE39EB73
                                                                                                                                                                                                                          SHA1:D070A01CC5A787249BC6DAD184B249C4DD37396A
                                                                                                                                                                                                                          SHA-256:A9C34F595E547CE94EE65E27C415195D2B210653A9FFCFB39559C5E0FA9C06F8
                                                                                                                                                                                                                          SHA-512:AF23563602886A648A42B03CC5485D84FCC094AB90B08DF5261434631B6C31CE38D83A3A60CC7820890C797F6C778D5B5EFF47671CE3EE4710AB14C6110DCC35
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Ttk widget set: progress bar utilities..#..namespace eval ttk::progressbar {. variable Timers.;# Map: widget name -> after ID.}..# Autoincrement --.#.Periodic callback procedure for autoincrement mode.#.proc ttk::progressbar::Autoincrement {pb steptime stepsize} {. variable Timers.. if {![winfo exists $pb]} {. .# widget has been destroyed -- cancel timer..unset -nocomplain Timers($pb)..return. }.. set Timers($pb) [after $steptime \. .[list ttk::progressbar::Autoincrement $pb $steptime $stepsize] ].. $pb step $stepsize.}..# ttk::progressbar::start --.#.Start autoincrement mode. Invoked by [$pb start] widget code..#.proc ttk::progressbar::start {pb {steptime 50} {stepsize 1}} {. variable Timers. if {![info exists Timers($pb)]} {..Autoincrement $pb $steptime $stepsize. }.}..# ttk::progressbar::stop --.#.Cancel autoincrement mode. Invoked by [$pb stop] widget code..#.proc ttk::progressbar::stop {pb} {. variable Timers. if {[info exists Timers($pb
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2698
                                                                                                                                                                                                                          Entropy (8bit):4.7624002445430955
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:6Zsdayx/HZtYRqucO6wEKyRtZt0TcKVqZ4TFZkPDMiNf:Wde/5tYRquMwEKyFt0TcKVG4TrkLMwf
                                                                                                                                                                                                                          MD5:B41A9DF31924DEA36D69CB62891E8472
                                                                                                                                                                                                                          SHA1:4C2877FBB210FDBBDE52EA8B5617F68AD2DF7B93
                                                                                                                                                                                                                          SHA-256:25D0FE2B415292872EF7ACDB2DFA12D04C080B7F9B1C61F28C81AA2236180479
                                                                                                                                                                                                                          SHA-512:A50DB6DA3D40D07610629DE45F06A438C6F2846324C3891C54C99074CFB7BEED329F27918C8A85BADB22C6B64740A2053B891F8E5D129D9B0A1FF103E7137D83
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# scale.tcl - Copyright (C) 2004 Pat Thoyts <patthoyts@users.sourceforge.net>.#.# Bindings for the TScale widget..namespace eval ttk::scale {. variable State. array set State {..dragging 0. }.}..bind TScale <ButtonPress-1> { ttk::scale::Press %W %x %y }.bind TScale <B1-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-1> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-2> { ttk::scale::Jump %W %x %y }.bind TScale <B2-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-2> { ttk::scale::Release %W %x %y }..bind TScale <ButtonPress-3> { ttk::scale::Jump %W %x %y }.bind TScale <B3-Motion> { ttk::scale::Drag %W %x %y }.bind TScale <ButtonRelease-3> { ttk::scale::Release %W %x %y }..## Keyboard navigation bindings:.#.bind TScale <<LineStart>> { %W set [%W cget -from] }.bind TScale <<LineEnd>> { %W set [%W cget -to] }..bind TScale <<PrevChar>> { ttk::scale::Increment %W -1 }.bind TScale <<PrevLine>> {
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):3097
                                                                                                                                                                                                                          Entropy (8bit):4.913511104649656
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:OsSofRsvfH3Noo2kvrjnWG3Lcyst0Rhrdy:plcHdoorDjWEFeuTy
                                                                                                                                                                                                                          MD5:93181DBE76EF9C39849A09242D6DF8C0
                                                                                                                                                                                                                          SHA1:DE3B47AFC3E5371BF1CD0541790A9B78A97570AB
                                                                                                                                                                                                                          SHA-256:5932043286A30A3CFFB2B6CE68CCDB9172A718F32926E25D3A962AE63CAD515C
                                                                                                                                                                                                                          SHA-512:5C85284E063A5DE17F6CE432B3EF899D046A78725BD1F930229576BED1116C03A3EE0611B988E9903F47DA8F694483E5A76464450C48EB14622F6784004B8F7E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Bindings for TScrollbar widget.#..# Still don't have a working ttk::scrollbar under OSX -.# Swap in a [tk::scrollbar] on that platform,.# unless user specifies -class or -style..#.if {[tk windowingsystem] eq "aqua"} {. rename ::ttk::scrollbar ::ttk::_scrollbar. proc ttk::scrollbar {w args} {..set constructor ::tk::scrollbar..foreach {option _} $args {.. if {$option eq "-class" || $option eq "-style"} {...set constructor ::ttk::_scrollbar...break.. }..}..return [$constructor $w {*}$args]. }.}..namespace eval ttk::scrollbar {. variable State. # State(xPress).--. # State(yPress).-- initial position of mouse at start of drag.. # State(first).-- value of -first at start of drag..}..bind TScrollbar <ButtonPress-1> .{ ttk::scrollbar::Press %W %x %y }.bind TScrollbar <B1-Motion>..{ ttk::scrollbar::Drag %W %x %y }.bind TScrollbar <ButtonRelease-1>.{ ttk::scrollbar::Release %W %x %y }..bind TScrollbar <ButtonPress-2> .{ ttk::scrollbar::Jump %W %x %y }.bind TScrollb
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2406
                                                                                                                                                                                                                          Entropy (8bit):4.78080326075935
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:KqL4LUBItZ3EZEhHR4vuRbMMie8GMW/H7vZZNQdqrYfy2nL+ZZvBb:KDYBIjHHRmiM1qvbnNQdqriyQIvB
                                                                                                                                                                                                                          MD5:3C8916A58C6EE1D61836E500A54C9321
                                                                                                                                                                                                                          SHA1:54F3F709698FAD020A048668749CB5A09EDE35AB
                                                                                                                                                                                                                          SHA-256:717D2EDD71076EA059903C7144588F8BBD8B0AFE69A55CBF23953149D6694D33
                                                                                                                                                                                                                          SHA-512:2B71569A5A96CAC1B708E894A2466B1054C3FAE5405E10799B182012141634BD2A7E9E9F516658E1A6D6E9E776E397608B581501A6CFE2EB4EC54459E9ECB267
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Sizegrip widget bindings..#.# Dragging a sizegrip widget resizes the containing toplevel..#.# NOTE: the sizegrip widget must be in the lower right hand corner..#..switch -- [tk windowingsystem] {. x11 -. win32 {..option add *TSizegrip.cursor [ttk::cursor seresize] widgetDefault. }. aqua {. .# Aqua sizegrips use default Arrow cursor.. }.}..namespace eval ttk::sizegrip {. variable State. array set State {..pressed .0..pressX ..0..pressY ..0..width ..0..height ..0..widthInc.1..heightInc.1. resizeX 1. resizeY 1..toplevel .{}. }.}..bind TSizegrip <ButtonPress-1> ..{ ttk::sizegrip::Press.%W %X %Y }.bind TSizegrip <B1-Motion> ..{ ttk::sizegrip::Drag .%W %X %Y }.bind TSizegrip <ButtonRelease-1> .{ ttk::sizegrip::Release %W %X %Y }..proc ttk::sizegrip::Press {W X Y} {. variable State.. if {[$W instate disabled]} { return }.. set top [winfo toplevel $W].. # If the toplevel is not resizable then bail. foreach {State(resiz
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4255
                                                                                                                                                                                                                          Entropy (8bit):4.9576194953603006
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:17n+wMf6/ocy2nO6lz+Ni2QQ0Q3LqSFLfhrxJSS3hQb:ln+wMOxVlaNi2QQ0QbdFLfhrxJzhQb
                                                                                                                                                                                                                          MD5:86BCA3AB915C2774425B70420E499140
                                                                                                                                                                                                                          SHA1:FD4798D79EEBA9CFFABCB2548068591DB531A716
                                                                                                                                                                                                                          SHA-256:51F8A6C772648541684B48622FFE41B77871A185A8ACD11E9DEC9EC41D65D9CD
                                                                                                                                                                                                                          SHA-512:659FB7E1631ED898E3C11670A04B953EB05CECB42A3C5EFBDD1BD97A7F99061920FD5DB3915476F224BB2C72358623E1B474B0FC3FBB7FD3734487B87A388FD7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# ttk::spinbox bindings.#..namespace eval ttk::spinbox { }..### Spinbox bindings..#.# Duplicate the Entry bindings, override if needed:.#..ttk::copyBindings TEntry TSpinbox..bind TSpinbox <Motion>...{ ttk::spinbox::Motion %W %x %y }.bind TSpinbox <ButtonPress-1> ..{ ttk::spinbox::Press %W %x %y }.bind TSpinbox <ButtonRelease-1> .{ ttk::spinbox::Release %W }.bind TSpinbox <Double-Button-1> .{ ttk::spinbox::DoubleClick %W %x %y }.bind TSpinbox <Triple-Button-1> .{} ;# disable TEntry triple-click..bind TSpinbox <KeyPress-Up>..{ event generate %W <<Increment>> }.bind TSpinbox <KeyPress-Down> ..{ event generate %W <<Decrement>> }..bind TSpinbox <<Increment>>..{ ttk::spinbox::Spin %W +1 }.bind TSpinbox <<Decrement>> ..{ ttk::spinbox::Spin %W -1 }..ttk::bindMouseWheel TSpinbox ..[list ttk::spinbox::MouseWheel %W]..## Motion --.#.Sets cursor..#.proc ttk::spinbox::Motion {w x y} {. if { [$w identify $x $y] eq "textarea". && [$w instate {!readonly !disabled}]. } {..ttk::setCurso
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8898
                                                                                                                                                                                                                          Entropy (8bit):4.860766938410698
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:2Ou002WQZ4sNNxjKomA3xj9L/37NbbF3r3G4eeMxCSbk3TPMrngEibSB1GjwPBKf:ZWeZ5BDFK+DsXibSQUMHLCGLdE2bZ
                                                                                                                                                                                                                          MD5:46B1D0EADBCF11AC51DD14B1A215AE04
                                                                                                                                                                                                                          SHA1:339026AE9533F4C331ADF8C71799B222DDD89D4F
                                                                                                                                                                                                                          SHA-256:DB6FAA8540C322F3E314968256D8AFFF39A1E4700EC17C7EFE364241F355D80F
                                                                                                                                                                                                                          SHA-512:0FC81426857949D5AC9FE7FF3C85A1270BD35BF6E6EAF3FE7AE0DE22A0C0E5CD96D6C9471216DC1DA673FAD949CA96A3751C3D3222474D2206AA9D8A455BA12E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# ttk::treeview widget bindings and utilities..#..namespace eval ttk::treeview {. variable State.. # Enter/Leave/Motion. #. set State(activeWidget) .{}. set State(activeHeading) .{}.. # Press/drag/release:. #. set State(pressMode) .none. set State(pressX)..0.. # For pressMode == "resize". set State(resizeColumn).#0.. # For pressmode == "heading". set State(heading) .{}.}..### Widget bindings..#..bind Treeview.<Motion> ..{ ttk::treeview::Motion %W %x %y }.bind Treeview.<B1-Leave>..{ #nothing }.bind Treeview.<Leave>...{ ttk::treeview::ActivateHeading {} {}}.bind Treeview.<ButtonPress-1> .{ ttk::treeview::Press %W %x %y }.bind Treeview.<Double-ButtonPress-1> .{ ttk::treeview::DoubleClick %W %x %y }.bind Treeview.<ButtonRelease-1> .{ ttk::treeview::Release %W %x %y }.bind Treeview.<B1-Motion> ..{ ttk::treeview::Drag %W %x %y }.bind Treeview .<KeyPress-Up> .{ ttk::treeview::Keynav %W up }.bind Treeview .<KeyPress-Down> .{ ttk::treeview::Keynav %
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4546
                                                                                                                                                                                                                          Entropy (8bit):4.888987944406022
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:96:53a25129CKELfMonw+PzpaVnNqovaq2126262R2D2q2k2j+/2FhbtpGt0vcWOQRg:53j5MoKE7JEnN7CTMDDA6Tlj+uFhbttK
                                                                                                                                                                                                                          MD5:E38B399865C45E49419C01FF2ADDCE75
                                                                                                                                                                                                                          SHA1:F8A79CBC97A32622922D4A3A5694BCCB3F19DECB
                                                                                                                                                                                                                          SHA-256:61BAA0268770F127394A006340D99CE831A1C7AD773181C0C13122F7D2C5B7F6
                                                                                                                                                                                                                          SHA-512:285F520B648F5EC70DD79190C3B456F4D6DA2053210985F9E2C84139D8D51908296E4962B336894EE30536F09FAE84B912BC2ABF44A7011620F66CC5D9F71A8C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Ttk widget set initialization script..#..### Source library scripts..#..namespace eval ::ttk {. variable library. if {![info exists library]} {..set library [file dirname [info script]]. }.}..source [file join $::ttk::library fonts.tcl].source [file join $::ttk::library cursors.tcl].source [file join $::ttk::library utils.tcl]..## ttk::deprecated $old $new --.#.Define $old command as a deprecated alias for $new command.#.$old and $new must be fully namespace-qualified..#.proc ttk::deprecated {old new} {. interp alias {} $old {} ttk::do'deprecate $old $new.}.## do'deprecate --.#.Implementation procedure for deprecated commands --.#.issue a warning (once), then re-alias old to new..#.proc ttk::do'deprecate {old new args} {. deprecated'warning $old $new. interp alias {} $old {} $new. uplevel 1 [linsert $args 0 $new].}..## deprecated'warning --.#.Gripe about use of deprecated commands..#.proc ttk::deprecated'warning {old new} {. puts stderr "$old deprecated -- u
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):8562
                                                                                                                                                                                                                          Entropy (8bit):4.958950985117383
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:MpEpXI4jqmW/y3gp9F+QE9PBRc+vWHJOfqW8j3ki3LDRdielRu+MXw+:6yXuwg1oPnc+epOEj31/s/5
                                                                                                                                                                                                                          MD5:65193FE52D77B8726B75FBF909EE860A
                                                                                                                                                                                                                          SHA1:991DEDD4666462DD9776FDF6C21F24D6CF794C85
                                                                                                                                                                                                                          SHA-256:C7CC9A15CFA999CF3763772729CC59F629E7E060AF67B7D783C50530B9B756E1
                                                                                                                                                                                                                          SHA-512:E43989F5F368D2E19C9A3521FB82C6C1DD9EEB91DF936A980FFC7674C8B236CB84E113908B8C9899B85430E8FC30315BDEC891071822D701C91C5978096341B7
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Utilities for widget implementations..#..### Focus management..#.# See also: #1516479.#..## ttk::takefocus --.#.This is the default value of the "-takefocus" option.#.for ttk::* widgets that participate in keyboard navigation..#.# NOTES:.#.tk::FocusOK (called by tk_focusNext) tests [winfo viewable].#.if -takefocus is 1, empty, or missing; but not if it's a.#.script prefix, so we have to check that here as well..#.#.proc ttk::takefocus {w} {. expr {[$w instate !disabled] && [winfo viewable $w]}.}..## ttk::GuessTakeFocus --.#.This routine is called as a fallback for widgets.#.with a missing or empty -takefocus option..#.#.It implements the same heuristics as tk::FocusOK..#.proc ttk::GuessTakeFocus {w} {. # Don't traverse to widgets with '-state disabled':. #. if {![catch {$w cget -state} state] && $state eq "disabled"} {..return 0. }.. # Allow traversal to widgets with explicit key or focus bindings:. #. if {[regexp {Key|Focus} [concat [bind $w] [bind [winfo c
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):9670
                                                                                                                                                                                                                          Entropy (8bit):4.6132627565634055
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:kSsdZ6XzgE2kiSCyNPNVVSCIA5l/r5l/rW+i/CE38S7r/2JeJnpna+yfdyMq53Id:QZ6XzD2kFVeArPKJ3z7cQ0383cdd
                                                                                                                                                                                                                          MD5:ED071B9CEA98B7594A7E74593211BD38
                                                                                                                                                                                                                          SHA1:90998A1A51BCBAA3B4D72B08F5CBF19E330148D2
                                                                                                                                                                                                                          SHA-256:98180630FC1E8D7D7C1B20A5FF3352C8BD8CF259DD4EB3B829B8BD4CB8AE76A4
                                                                                                                                                                                                                          SHA-512:60C1EA45481AF5CFA3C5E579514DD3F4AC6C8D168553F374D0A3B3E1342E76CB71FA825C306233E185BED057E2B99877BAF9A5E88EBD48CF6DE171A8E7F6A230
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Settings for Microsoft Windows Vista and Server 2008.#..# The Vista theme can only be defined on Windows Vista and above. The theme.# is created in C due to the need to assign a theme-enabled function for .# detecting when themeing is disabled. On systems that cannot support the.# Vista theme, there will be no such theme created and we must not.# evaluate this script...if {"vista" ni [ttk::style theme names]} {. return.}..namespace eval ttk::theme::vista {.. ttk::style theme settings vista {.. .ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -insertcolor SystemWindowText \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -pa
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2867
                                                                                                                                                                                                                          Entropy (8bit):4.876730704118724
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:679ahSh6FPGh0Ds0IXF6yjAfSAfqFRaBgLtei42kt+5Ql/n+iOaVhttZLgtKZLtO:6UJM0uTk5tm4RX0
                                                                                                                                                                                                                          MD5:0AE8205DFBA3C9B8EEAD01AC11C965D6
                                                                                                                                                                                                                          SHA1:61E8D2E909CF46886F6EA8571D4234DD336FEFB3
                                                                                                                                                                                                                          SHA-256:93E4011CAA9F01802D6DD5E02C3104E619084799E949974DFEE5E0C94D1E3952
                                                                                                                                                                                                                          SHA-512:E4448B922CA0FB425F879988537B9DB8F8C8A5A773805607574499506FDD9DEEB9CD41660E497002F78727AFBE3BEC17D9674E99CEF4A9D66FFD9C4536AFE153
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Settings for 'winnative' theme..#..namespace eval ttk::theme::winnative {. ttk::style theme settings winnative {...ttk::style configure "." \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -fieldbackground SystemWindow \.. -insertcolor SystemWindowText \.. -troughcolor SystemScrollbar \.. -font TkDefaultFont \.. ;...ttk::style map "." -foreground [list disabled SystemGrayText] ;. ttk::style map "." -embossed [list disabled 1] ;...ttk::style configure TButton \.. -anchor center -width -11 -relief raised -shiftrelief 1..ttk::style configure TCheckbutton -padding "2 4"..ttk::style configure TRadiobutton -padding "2 4"..ttk::style configure TMenubutton \.. -padding "8 4" -arrowsize 3 -relief raised...ttk::style map TButton -relief {{!disabled pressed} sunken}...ttk::style configure TEntry \.. -padding 2 -selectborderwidth 0 -insertwidth 1..t
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):2375
                                                                                                                                                                                                                          Entropy (8bit):4.931678702435916
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:48:NaxYun9ahShCd/T5QNt+7aVzEmAf8Afb9AfMMB+iOaVhttZLgtKZLti:k41eTXM
                                                                                                                                                                                                                          MD5:BD892A940333C1B804DF5C4594B0A5E6
                                                                                                                                                                                                                          SHA1:4E187F09F45898749CFE7860EDEF0D5EB83D764E
                                                                                                                                                                                                                          SHA-256:196C6FEF40FB6296D7762F30058AA73273083906F72F490E69FC77F1D5589B88
                                                                                                                                                                                                                          SHA-512:8273A8F789D695601A7BC74DFA2A6BD7FE280EC528869F502A578E90B6DD1613C4BCC5B6CD0D93A5CA0E6538BE740CD370F634DA84064213E1F50B919EBF35B8
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:#.# Settings for 'xpnative' theme.#..namespace eval ttk::theme::xpnative {.. ttk::style theme settings xpnative {...ttk::style configure . \.. -background SystemButtonFace \.. -foreground SystemWindowText \.. -selectforeground SystemHighlightText \.. -selectbackground SystemHighlight \.. -insertcolor SystemWindowText \.. -font TkDefaultFont \.. ;...ttk::style map "." \.. -foreground [list disabled SystemGrayText] \.. ;...ttk::style configure TButton -anchor center -padding {1 1} -width -11..ttk::style configure TRadiobutton -padding 2..ttk::style configure TCheckbutton -padding 2..ttk::style configure TMenubutton -padding {8 4}...ttk::style configure TNotebook -tabmargins {2 2 2 0}..ttk::style map TNotebook.Tab \.. -expand [list selected {2 2 2 2}]...# Treeview:..ttk::style configure Heading -font TkHeadingFont..ttk::style configure Treeview -background SystemWindow..ttk::style map Treeview \.. -background [list selected SystemHighlight] \.. -fore
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10252
                                                                                                                                                                                                                          Entropy (8bit):5.02143730499245
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:1kMv11IDCB7PFPHGosvS6UMn8O9MGM/OTMjcrrwrt:xuMYMj+sZ
                                                                                                                                                                                                                          MD5:C832FDF24CA1F5C5E9B33FA5ECD11CAC
                                                                                                                                                                                                                          SHA1:8082FDE50C428D2511B05F529FCCF02651D5AC93
                                                                                                                                                                                                                          SHA-256:E34D828E740F151B96022934AAEC7BB8343E23D040FB54C04641888F51767EB8
                                                                                                                                                                                                                          SHA-512:58BEB05778271D4C91527B1CB23491962789D95ACCBC6C28E25D05BD3D6172AAC9A90E7741CD606C69FB8CECC29EE515DA7C7D4E6098BF67F08F18DFB7983323
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# unsupported.tcl --.#.# Commands provided by Tk without official support. Use them at your.# own risk. They may change or go away without notice..#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...# ----------------------------------------------------------------------.# Unsupported compatibility interface for folks accessing Tk's private.# commands and variable against recommended usage..# ----------------------------------------------------------------------..namespace eval ::tk::unsupported {.. # Map from the old global names of Tk private commands to their. # new namespace-encapsulated names... variable PrivateCommands. array set PrivateCommands {..tkButtonAutoInvoke..::tk::ButtonAutoInvoke..tkButtonDown...::tk::ButtonDown..tkButtonEnter...::tk::ButtonEnter..tkButtonInvoke...::tk::ButtonInvoke..tkButtonLeave...::tk::ButtonLeave..tkButtonUp...::tk::ButtonUp..tkCancelRepeat...::tk::Cance
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):26075
                                                                                                                                                                                                                          Entropy (8bit):4.9212533677507535
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:obPA7Xi6V2+Bec3ipnFH6HZ1KDZvRcbQ3sd1GkjDo413lK/RIV5MXrSomsjiETwM:orA3TVJc3sd1GkF3cIVf591w
                                                                                                                                                                                                                          MD5:F863B7C5680017EE9F744900CC6C3834
                                                                                                                                                                                                                          SHA1:155E6E8752F6D48EF8D32CE2228E17EE58C2768E
                                                                                                                                                                                                                          SHA-256:9C78A976BBC933863FB0E4C23EE62B26F8EB3D7F101D7D32E6768579499E43B1
                                                                                                                                                                                                                          SHA-512:34F5B51EA1A2EFCD53B51A74E7E9B69FB154E017527BBD1CB3961F1619E74BE9D49D0583D193DBA7E8A3904F6C7446F278BC7977011DCCDAEBBE42D71FA5630C
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# xmfbox.tcl --.#.#.Implements the "Motif" style file selection dialog for the.#.Unix platform. This implementation is used only if the.#."::tk_strictMotif" flag is set..#.# Copyright (c) 1996 Sun Microsystems, Inc..# Copyright (c) 1998-2000 Scriptics Corporation.#.# See the file "license.terms" for information on usage and redistribution.# of this file, and for a DISCLAIMER OF ALL WARRANTIES...namespace eval ::tk::dialog {}.namespace eval ::tk::dialog::file {}...# ::tk::MotifFDialog --.#.#.Implements a file dialog similar to the standard Motif file.#.selection box..#.# Arguments:.#.type.."open" or "save".#.args..Options parsed by the procedure..#.# Results:.#.When -multiple is set to 0, this returns the absolute pathname.#.of the selected file. (NOTE: This is not the same as a single.#.element list.).#.#.When -multiple is set to > 0, this returns a Tcl list of absolute.# pathnames. The argument for -multiple is ignored, but for consistency.# with Windows it defines the max
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):1119760
                                                                                                                                                                                                                          Entropy (8bit):5.371858754181543
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:12288:teTMmuZ63NHQCb5Pfhnzr0ql8L8kUM7IRG5eeme6VZyrIBHdQLhfFE+uRbenwr:teTuoZV0m8MMMREtV6Vo4uYR9r
                                                                                                                                                                                                                          MD5:8320C54418D77EBA5D4553A5D6EC27F9
                                                                                                                                                                                                                          SHA1:E5123CF166229AEBB076B469459856A56FB16D7F
                                                                                                                                                                                                                          SHA-256:7E719BA47919B668ACC62008079C586133966ED8B39FEC18E312A773CB89EDAE
                                                                                                                                                                                                                          SHA-512:B9E6CDCB37D26FF9C573381BDA30FA4CF1730361025CD502B67288C55744962BDD0A99790CEDD4A48FEEF3139E3903265AB112EC545CB1154EAA2A91201F6B34
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............,..,..,..l,..,...-..,...-..,...-..,...-..,Y..-..,...-..,..,...,Y..-..,Y..-..,Y..,..,Y..-..,Rich..,........PE..d....={_.........." .....J...........).......................................@............`.............................................X...X........ .......................0......`L..T............................L..0............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):14848
                                                                                                                                                                                                                          Entropy (8bit):5.114869094150954
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:192:zrCm72PEO1jIUs0YqEcPbF55UgCWV4rofnbPztEZoqDLWn7ycLmrD/:zrardA0Bzx14r6nb/0WE/
                                                                                                                                                                                                                          MD5:BB187E1456794B37F3426B41D6936B55
                                                                                                                                                                                                                          SHA1:4284D971B02916F11DC4F0FEE475A8ECF4B45078
                                                                                                                                                                                                                          SHA-256:AF26AF0958BD9A0FEA51F0FD9630C187A29B6F4AAEA3C09C625B93ABA2CC22BF
                                                                                                                                                                                                                          SHA-512:013193A445C5DE347CDBE2A7ECBAD836ECB8CF8A487176591F4A1A905A30582BC4314D74218195B1FCB82B69EC23CE6F2E8CEA23DB3FDFE17B0EAE74064990BF
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Pf..1...1...1...I...1..D...1...Z...1..D...1..D...1..D...1..BX...1...1...1...D...1...D...1...D...1..Rich.1..................PE..d......d.........." ......................................................................`..........................................;..`...`;..d....p..l....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..$....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...l....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):133632
                                                                                                                                                                                                                          Entropy (8bit):5.851469350935171
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:pI+kHubb2wCc8Rd0BvDAQolRVFhLaNKPNyymA4FZ5dorG0e:ShObbac8Rd0BUlRVlPNynFZ57
                                                                                                                                                                                                                          MD5:05E4B3B876E5FA6A2B8951F764559623
                                                                                                                                                                                                                          SHA1:4AD50F70EEF4FEAA9D051C2F161FBAC8A862A4BC
                                                                                                                                                                                                                          SHA-256:A52F8BD28B5B9558CDE10333CE452A7D6F338CE1005A2B8451755005868E4A98
                                                                                                                                                                                                                          SHA-512:5648306AF7C056C9250731B7D5A508664294BBB8BA865F9DC06FD7216ADF7B8CC31B1CFBC0175C7F2752680744F6546A1959E7F7D1EC7A8A845F75642CE034D9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.uV0...0...0...9...8...b...4...b...8...b...4.......2.......2...b...'...$...;...0...g.......2.......1.......1...Rich0...................PE..d......d.........." .........................................................P............`..........................................................0..T....................@..$....v..T............................<..8............0..........@....................text............................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...T....0......................@..@.reloc..$....@......................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):124416
                                                                                                                                                                                                                          Entropy (8bit):5.961248400051204
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3072:qMTeHaAQiijmswWBLpbFf9AbWKPpH9UlcU23a:qMTeHaziijmsw+UxH6l8
                                                                                                                                                                                                                          MD5:A67B8DB9D41F93CB0A22C08738EC265C
                                                                                                                                                                                                                          SHA1:FBF1C672B68CE67F2E3EBF780F234C26AE1D86CB
                                                                                                                                                                                                                          SHA-256:D351F3B7CF5A6440A245353985EBE2336080D5D7A62AF6E04339D3E8EFF028BF
                                                                                                                                                                                                                          SHA-512:6B4905942F7686D6639F01B00E02ABB5BFB678CCF55B7686D462E10BF837C12D74CFAA0B0F20A218A11489A8745A0BBDC2F73A85900C9748F3E3A7B0E6CBC695
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................J............................Z......................C...Z......Z......Z......Rich............................PE..d......d.........." ................X........................................ ............`.........................................0o.................\.......................H....G..T............................H..8............... ............................text............................... ..`.rdata..*...........................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...\...........................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):34816
                                                                                                                                                                                                                          Entropy (8bit):5.6127326100217365
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:768:7M47+YedBm0W70IuuGig44ttAYSRgEKtha:71pwQ0ouuxRd+a
                                                                                                                                                                                                                          MD5:ABE99FC1DC3D9BF69F723387E85603D5
                                                                                                                                                                                                                          SHA1:1B256C920A06B051645FCF1CD7094CADC573F2F2
                                                                                                                                                                                                                          SHA-256:86D6F955C1564247B6637E4827AF574EBAF47DA69A3E0553D2D5E1F6BD831247
                                                                                                                                                                                                                          SHA-512:4578E845823B1A3BA1B0F44C1E11885ACE8E1648659E6DD5480F10F7D0CCD1327E41447A94B034FB04FFFAA81321D6596165EB571EDFDA42EFEB08CEA440A9D0
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z4d.;Z7.;Z7.;Z7.C.7.;Z7.N[6.;Z7.P[6.;Z7.N_6.;Z7.N^6.;Z7.NY6.;Z7#N[6.;Z7zR[6.;Z7.;[7.;Z7#NS6.;Z7#NZ6.;Z7#NX6.;Z7Rich.;Z7................PE..d......d.........." .....D...@.......@....................................................`.........................................0...P...............T............................p..T............................p..8............`...............................text....C.......D.................. ..`.rdata..H,...`.......H..............@..@.data...x............v..............@....pdata...............z..............@..@.rsrc...T...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):23552
                                                                                                                                                                                                                          Entropy (8bit):5.276917458697061
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:384:RhhYugi3RZNuX9jXG23R+0I1FERUgg0T8DmNRWqjWPgHKpC9SUayj1Bg:3+hGwX9jjrWEWITzxB
                                                                                                                                                                                                                          MD5:62ED323CD0A1F81251826A0DD2F2CD94
                                                                                                                                                                                                                          SHA1:4E7A61EABC958FA645527978F3DE4537FA20103F
                                                                                                                                                                                                                          SHA-256:94738D17F1015127B01E1E4375FC81602CE20ACAC4DFFEC8CFCF29C679591212
                                                                                                                                                                                                                          SHA-512:98CFC367B14B15978B931C8D46ECEBA91C1360440DCE0F59069F8DA0E2B85964F475EB8DE0B45FE81FD5CA7DDD64FC2158E0A00119D776E00D4C59B3DABEA89E
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.*U.qD..qD..qD......qD.F.E..qD.F.A..qD.F.@..qD.F.G..qD...E..qD...E..qD...E..qD..qE.YqD...M..qD...D..qD...F..qD.Rich.qD.........................PE..d......d.........." .....,...,.......'....................................................`..........................................Q..T...dQ..........\....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...\............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):528896
                                                                                                                                                                                                                          Entropy (8bit):6.169158824265627
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:6144:OB+Kwmy5L0kOMTe8leskN/LgUs0wK7l4a5KsKnphSV3Mah/jh1jhbC0:OMFmOHOMTenRRea5KsKnph6hthbC0
                                                                                                                                                                                                                          MD5:A6130B5B59DD0AD4251608639F7FBE6E
                                                                                                                                                                                                                          SHA1:125A4DFD1EABF36347212973A49576A529DE3058
                                                                                                                                                                                                                          SHA-256:E51C3E1260A093108309DD1E9BFC9E0F212D19BB386B9324671D615C32FB2F84
                                                                                                                                                                                                                          SHA-512:E9D1E88BC0A0D31B1432F45220E660AE274C9019FDF919AA890A08FD5DD82C674B81C079F8D36DED4BD0D446C3EEB61C889E905C7ECB0A24D71C68C0B44A45E5
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........]...]...]...T.).[......Y......N......U......Y...I..T......_.....Y...I..\...I..T...].............\.....\...Rich]...................PE..d...T..d.........." .....&................................................................`.........................................0...L...|...........D.......Py...............!......T..............................8............@.. ............................text....$.......&.................. ..`.rdata..@....@.......*..............@..@.data...@....0...^..................@....pdata..Py.......z...r..............@..@.rsrc...D...........................@..@.reloc...!......."..................@..B........................................................................................................................................................................................................................
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):4
                                                                                                                                                                                                                          Entropy (8bit):2.0
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:qn:qn
                                                                                                                                                                                                                          MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                          SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                          SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                          SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:blat
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):176
                                                                                                                                                                                                                          Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                          MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                          SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                          SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                          SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..
                                                                                                                                                                                                                          Process:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          File Type:data
                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                          Size (bytes):10
                                                                                                                                                                                                                          Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                          SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                          MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                          SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                          SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                          SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                          Malicious:false
                                                                                                                                                                                                                          Preview:..K....}..
                                                                                                                                                                                                                          File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                          Entropy (8bit):7.995853111857083
                                                                                                                                                                                                                          TrID:
                                                                                                                                                                                                                          • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                                                                                                          • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                          • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                          • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                          File name:explorer.exe.0.exe
                                                                                                                                                                                                                          File size:102'917'049 bytes
                                                                                                                                                                                                                          MD5:490b24aaabfd71dc7561947289b252a5
                                                                                                                                                                                                                          SHA1:ac2d9ec2cd024fff564e4e397ec8fbc9e65594d2
                                                                                                                                                                                                                          SHA256:2ebd029b1d588dda7d230b3776c3fa99c399f90449cd2dbdd79b071331efe4c6
                                                                                                                                                                                                                          SHA512:fa80aa32a66211d4d33fa7e51d502e8418d8928c9f0d810c3d40ffb1f35a968ff6afd1c1fafe5259488e2612eff198481e5a89288752119110662595a92e65c6
                                                                                                                                                                                                                          SSDEEP:3145728:lcogYRPSC++6y9J2sTdet/VG6RmtCRlGPr/2qHO5icEP9:bxaC4y9vd65mERluhHCiPP
                                                                                                                                                                                                                          TLSH:A8383368D7446CD8E1AA703BB1804B4FCC62FC1D27729197D6A031364ADF6EB5BD88B1
                                                                                                                                                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1_..P1..P1..P1..(2..P1..(4.|P1..(5..P1../...P1../4..P1../5..P1../2..P1..(0..P1..P0..P1...5..P1...3..P1.Rich.P1................
                                                                                                                                                                                                                          Icon Hash:12f13ee9d61f1f3b
                                                                                                                                                                                                                          Entrypoint:0x14000b6d0
                                                                                                                                                                                                                          Entrypoint Section:.text
                                                                                                                                                                                                                          Digitally signed:false
                                                                                                                                                                                                                          Imagebase:0x140000000
                                                                                                                                                                                                                          Subsystem:windows cui
                                                                                                                                                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                          Time Stamp:0x663CA773 [Thu May 9 10:37:39 2024 UTC]
                                                                                                                                                                                                                          TLS Callbacks:
                                                                                                                                                                                                                          CLR (.Net) Version:
                                                                                                                                                                                                                          OS Version Major:5
                                                                                                                                                                                                                          OS Version Minor:2
                                                                                                                                                                                                                          File Version Major:5
                                                                                                                                                                                                                          File Version Minor:2
                                                                                                                                                                                                                          Subsystem Version Major:5
                                                                                                                                                                                                                          Subsystem Version Minor:2
                                                                                                                                                                                                                          Import Hash:bae3d3e8262d7ce7e9ee69cc1b630d3a
                                                                                                                                                                                                                          Instruction
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 28h
                                                                                                                                                                                                                          call 00007F1E3D2391ACh
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          add esp, 28h
                                                                                                                                                                                                                          jmp 00007F1E3D238DAFh
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 28h
                                                                                                                                                                                                                          call 00007F1E3D2396F4h
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          je 00007F1E3D238F63h
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                          jmp 00007F1E3D238F47h
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          cmp ecx, eax
                                                                                                                                                                                                                          je 00007F1E3D238F56h
                                                                                                                                                                                                                          xor eax, eax
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          cmpxchg dword ptr [00034D9Ch], ecx
                                                                                                                                                                                                                          jne 00007F1E3D238F30h
                                                                                                                                                                                                                          xor al, al
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          add esp, 28h
                                                                                                                                                                                                                          ret
                                                                                                                                                                                                                          mov al, 01h
                                                                                                                                                                                                                          jmp 00007F1E3D238F39h
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          inc eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 20h
                                                                                                                                                                                                                          movzx eax, byte ptr [00034D87h]
                                                                                                                                                                                                                          test ecx, ecx
                                                                                                                                                                                                                          mov ebx, 00000001h
                                                                                                                                                                                                                          cmove eax, ebx
                                                                                                                                                                                                                          mov byte ptr [00034D77h], al
                                                                                                                                                                                                                          call 00007F1E3D2394F3h
                                                                                                                                                                                                                          call 00007F1E3D23A622h
                                                                                                                                                                                                                          test al, al
                                                                                                                                                                                                                          jne 00007F1E3D238F46h
                                                                                                                                                                                                                          xor al, al
                                                                                                                                                                                                                          jmp 00007F1E3D238F56h
                                                                                                                                                                                                                          call 00007F1E3D2483C1h
                                                                                                                                                                                                                          test al, al
                                                                                                                                                                                                                          jne 00007F1E3D238F4Bh
                                                                                                                                                                                                                          xor ecx, ecx
                                                                                                                                                                                                                          call 00007F1E3D23A632h
                                                                                                                                                                                                                          jmp 00007F1E3D238F2Ch
                                                                                                                                                                                                                          mov al, bl
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          add esp, 20h
                                                                                                                                                                                                                          pop ebx
                                                                                                                                                                                                                          ret
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          int3
                                                                                                                                                                                                                          inc eax
                                                                                                                                                                                                                          push ebx
                                                                                                                                                                                                                          dec eax
                                                                                                                                                                                                                          sub esp, 20h
                                                                                                                                                                                                                          cmp byte ptr [00034D3Ch], 00000000h
                                                                                                                                                                                                                          mov ebx, ecx
                                                                                                                                                                                                                          jne 00007F1E3D238FA9h
                                                                                                                                                                                                                          cmp ecx, 01h
                                                                                                                                                                                                                          jnbe 00007F1E3D238FACh
                                                                                                                                                                                                                          call 00007F1E3D23965Ah
                                                                                                                                                                                                                          test eax, eax
                                                                                                                                                                                                                          je 00007F1E3D238F6Ah
                                                                                                                                                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x3cce40x50.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000xeca0.rsrc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x420000x22ec.pdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x550000x75c.reloc
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x3a2500x1c.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3a1100x140.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x378.rdata
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                          .text0x10000x29e900x2a000431321828455afd06dbe6cf15357f834False0.5509730747767857zlib compressed data6.491397895602197IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rdata0x2b0000x1290a0x12a007fdab01f20b32ce927ff14ceb01c54edFalse0.5169620385906041data5.843092196088672IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .data0x3e0000x33380xe00033e0b425e93447b2ce3c4ec77bdc191False0.1328125Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 01.8240094210972881IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                          .pdata0x420000x22ec0x240077a254ebad6c1bd22dbd1dde663a151fFalse0.4777560763888889data5.320965296755752IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          _RDATA0x450000x15c0x20093b535486844748308ffa0159d41d884False0.392578125data2.8347903209012006IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .rsrc0x460000xeca00xee00afc6e24a5d3fe68cae234e649c1fca45False0.40961462710084034data6.177696175193033IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          .reloc0x550000x75c0x80050e469e3d07609e6ff26b5103d72e931False0.5478515625data5.238533766219297IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                          RT_ICON0x462380x3d58PNG image data, 256 x 0, 8-bit/color RGBA, non-interlaced0.9522414671421294
                                                                                                                                                                                                                          RT_ICON0x49f900x4228Device independent bitmap graphic, 64 x 128 x 32, image size 00.189891355692017
                                                                                                                                                                                                                          RT_ICON0x4e1b80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.237551867219917
                                                                                                                                                                                                                          RT_ICON0x507600x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 00.27662721893491127
                                                                                                                                                                                                                          RT_ICON0x521c80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.3339587242026266
                                                                                                                                                                                                                          RT_ICON0x532700x988Device independent bitmap graphic, 24 x 48 x 32, image size 00.42008196721311475
                                                                                                                                                                                                                          RT_ICON0x53bf80x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.4720930232558139
                                                                                                                                                                                                                          RT_ICON0x542b00x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.5443262411347518
                                                                                                                                                                                                                          RT_GROUP_ICON0x547180x76data0.7966101694915254
                                                                                                                                                                                                                          RT_MANIFEST0x547900x50dXML 1.0 document, ASCII text0.4694508894044857
                                                                                                                                                                                                                          DLLImport
                                                                                                                                                                                                                          USER32.dllGetWindowThreadProcessId, ShowWindow
                                                                                                                                                                                                                          KERNEL32.dllGetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, SetDllDirectoryW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, GetCurrentProcessId, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetConsoleWindow, HeapSize, GetLastError, WriteConsoleW, SetEndOfFile, GetStartupInfoW, TlsSetValue, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation
                                                                                                                                                                                                                          ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW
                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          May 10, 2024 11:11:39.112027884 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.112060070 CEST44349746172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.112152100 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.127842903 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.127867937 CEST44349746172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.363045931 CEST44349746172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.363929033 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.363955975 CEST44349746172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.365037918 CEST44349746172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.365104914 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.365781069 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.365925074 CEST44349746172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.365950108 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.365988970 CEST49746443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.370366096 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.370402098 CEST44349747172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.370493889 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.382030010 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.382045031 CEST44349747172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.613673925 CEST44349747172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.614129066 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.614140987 CEST44349747172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.615238905 CEST44349747172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.615310907 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.615772963 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.615912914 CEST44349747172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.615926027 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.615961075 CEST49747443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.620366096 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.620399952 CEST44349748172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.620488882 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.631292105 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.631308079 CEST44349748172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.862272978 CEST44349748172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.862658024 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.862673044 CEST44349748172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.863828897 CEST44349748172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.863893986 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.864336014 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.864469051 CEST49748443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.868616104 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.868659973 CEST44349749172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:39.868732929 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.880321980 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:39.880332947 CEST44349749172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.111552000 CEST44349749172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.111932039 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.111946106 CEST44349749172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.113004923 CEST44349749172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.113188028 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.113676071 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.113826036 CEST44349749172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.113826990 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.113884926 CEST49749443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.118318081 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.118357897 CEST44349750172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.118442059 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.128698111 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.128711939 CEST44349750172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.362974882 CEST44349750172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.363581896 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.363604069 CEST44349750172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.364712000 CEST44349750172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.364790916 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.365276098 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.365420103 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.365423918 CEST44349750172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.365470886 CEST49750443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.369941950 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.369977951 CEST44349751172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.370058060 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.381201982 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.381220102 CEST44349751172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.611838102 CEST44349751172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.612494946 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.612509966 CEST44349751172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.613607883 CEST44349751172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.613671064 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.614300013 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.614433050 CEST44349751172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.614447117 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.614485979 CEST49751443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.619060993 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.619092941 CEST44349752172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.619191885 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.629656076 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.629671097 CEST44349752172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.860280991 CEST44349752172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.860703945 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.860718966 CEST44349752172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.861758947 CEST44349752172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.861828089 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.862298965 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.862435102 CEST44349752172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.862481117 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.862494946 CEST49752443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.866645098 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.866688013 CEST44349753172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:40.866780043 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.876843929 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:40.876857042 CEST44349753172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.107872009 CEST44349753172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.108268023 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.108283043 CEST44349753172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.109287977 CEST44349753172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.109352112 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.109813929 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.109946012 CEST44349753172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.109950066 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.109986067 CEST49753443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.114496946 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.114531040 CEST44349754172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.114607096 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.124886036 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.124901056 CEST44349754172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.356021881 CEST44349754172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.356447935 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.356463909 CEST44349754172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.357563019 CEST44349754172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.357733011 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.358263016 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.358390093 CEST44349754172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.358408928 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.358436108 CEST49754443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.363121986 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.363147974 CEST44349755172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.363230944 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.373877048 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.373889923 CEST44349755172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.604665995 CEST44349755172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.605030060 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.605041981 CEST44349755172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.606061935 CEST44349755172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.606132030 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.606533051 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.606672049 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          May 10, 2024 11:11:41.606673002 CEST44349755172.217.4.65192.168.2.4
                                                                                                                                                                                                                          May 10, 2024 11:11:41.606719017 CEST49755443192.168.2.4172.217.4.65
                                                                                                                                                                                                                          TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                          May 10, 2024 11:11:38.998836994 CEST6481853192.168.2.41.1.1.1
                                                                                                                                                                                                                          May 10, 2024 11:11:39.109225988 CEST53648181.1.1.1192.168.2.4
                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                          May 10, 2024 11:11:38.998836994 CEST192.168.2.41.1.1.10x7383Standard query (0)drive.usercontent.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                          May 10, 2024 11:10:59.666821957 CEST1.1.1.1192.168.2.40x856dNo error (0)bg.microsoft.map.fastly.net199.232.210.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          May 10, 2024 11:10:59.666821957 CEST1.1.1.1192.168.2.40x856dNo error (0)bg.microsoft.map.fastly.net199.232.214.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          May 10, 2024 11:11:00.604876041 CEST1.1.1.1192.168.2.40x8c60No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                          May 10, 2024 11:11:00.604876041 CEST1.1.1.1192.168.2.40x8c60No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false
                                                                                                                                                                                                                          May 10, 2024 11:11:39.109225988 CEST1.1.1.1192.168.2.40x7383No error (0)drive.usercontent.google.com172.217.4.65A (IP address)IN (0x0001)false

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Click to dive into process behavior distribution

                                                                                                                                                                                                                          Click to jump to process

                                                                                                                                                                                                                          Target ID:0
                                                                                                                                                                                                                          Start time:11:11:15
                                                                                                                                                                                                                          Start date:10/05/2024
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\explorer.exe.0.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff75c2c0000
                                                                                                                                                                                                                          File size:102'917'049 bytes
                                                                                                                                                                                                                          MD5 hash:490B24AAABFD71DC7561947289B252A5
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          Target ID:1
                                                                                                                                                                                                                          Start time:11:11:15
                                                                                                                                                                                                                          Start date:10/05/2024
                                                                                                                                                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                          Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                          File size:862'208 bytes
                                                                                                                                                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:high
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          Target ID:5
                                                                                                                                                                                                                          Start time:11:11:35
                                                                                                                                                                                                                          Start date:10/05/2024
                                                                                                                                                                                                                          Path:C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                          Wow64 process (32bit):false
                                                                                                                                                                                                                          Commandline:"C:\Users\user\Desktop\explorer.exe.0.exe"
                                                                                                                                                                                                                          Imagebase:0x7ff75c2c0000
                                                                                                                                                                                                                          File size:102'917'049 bytes
                                                                                                                                                                                                                          MD5 hash:490B24AAABFD71DC7561947289B252A5
                                                                                                                                                                                                                          Has elevated privileges:true
                                                                                                                                                                                                                          Has administrator privileges:true
                                                                                                                                                                                                                          Programmed in:C, C++ or other language
                                                                                                                                                                                                                          Reputation:low
                                                                                                                                                                                                                          Has exited:true

                                                                                                                                                                                                                          Reset < >

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:11.2%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:16.6%
                                                                                                                                                                                                                            Total number of Nodes:2000
                                                                                                                                                                                                                            Total number of Limit Nodes:47
                                                                                                                                                                                                                            execution_graph 18836 7ff75c2db850 18837 7ff75c2db855 18836->18837 18838 7ff75c2db86a 18836->18838 18842 7ff75c2db870 18837->18842 18843 7ff75c2db8b2 18842->18843 18846 7ff75c2db8ba 18842->18846 18844 7ff75c2db1cc __free_lconv_num 11 API calls 18843->18844 18844->18846 18845 7ff75c2db1cc __free_lconv_num 11 API calls 18847 7ff75c2db8c7 18845->18847 18846->18845 18848 7ff75c2db1cc __free_lconv_num 11 API calls 18847->18848 18849 7ff75c2db8d4 18848->18849 18850 7ff75c2db1cc __free_lconv_num 11 API calls 18849->18850 18851 7ff75c2db8e1 18850->18851 18852 7ff75c2db1cc __free_lconv_num 11 API calls 18851->18852 18853 7ff75c2db8ee 18852->18853 18854 7ff75c2db1cc __free_lconv_num 11 API calls 18853->18854 18855 7ff75c2db8fb 18854->18855 18856 7ff75c2db1cc __free_lconv_num 11 API calls 18855->18856 18857 7ff75c2db908 18856->18857 18858 7ff75c2db1cc __free_lconv_num 11 API calls 18857->18858 18859 7ff75c2db915 18858->18859 18860 7ff75c2db1cc __free_lconv_num 11 API calls 18859->18860 18861 7ff75c2db925 18860->18861 18862 7ff75c2db1cc __free_lconv_num 11 API calls 18861->18862 18863 7ff75c2db935 18862->18863 18868 7ff75c2db718 18863->18868 18882 7ff75c2e0ea8 EnterCriticalSection 18868->18882 15920 7ff75c2cb54c 15941 7ff75c2cb72c 15920->15941 15923 7ff75c2cb6a3 16063 7ff75c2cba5c IsProcessorFeaturePresent 15923->16063 15924 7ff75c2cb56d __scrt_acquire_startup_lock 15926 7ff75c2cb6ad 15924->15926 15932 7ff75c2cb58b __scrt_release_startup_lock 15924->15932 15927 7ff75c2cba5c 7 API calls 15926->15927 15929 7ff75c2cb6b8 __CxxCallCatchBlock 15927->15929 15928 7ff75c2cb5b0 15930 7ff75c2cb636 15949 7ff75c2d9fd0 15930->15949 15932->15928 15932->15930 16052 7ff75c2da37c 15932->16052 15934 7ff75c2cb63b 15955 7ff75c2c1000 15934->15955 15938 7ff75c2cb65f 15938->15929 16059 7ff75c2cb8c0 15938->16059 16070 7ff75c2cbcfc 15941->16070 15944 7ff75c2cb75b 16072 7ff75c2dabdc 15944->16072 15945 7ff75c2cb565 15945->15923 15945->15924 15950 7ff75c2d9ff5 15949->15950 15951 7ff75c2d9fe0 15949->15951 15950->15934 15951->15950 16115 7ff75c2d9a60 15951->16115 15956 7ff75c2c1011 15955->15956 16168 7ff75c2c7910 15956->16168 15958 7ff75c2c1023 16175 7ff75c2d60c0 15958->16175 15960 7ff75c2c2af0 16182 7ff75c2c1eb0 15960->16182 15963 7ff75c2c2be6 15965 7ff75c2cb190 _wfindfirst32i64 8 API calls 15963->15965 15966 7ff75c2c2bfa 15965->15966 16057 7ff75c2cbbb0 GetModuleHandleW 15966->16057 15967 7ff75c2c2b0f 15967->15963 16198 7ff75c2c6d60 15967->16198 15969 7ff75c2c2b3c 15970 7ff75c2c2b87 15969->15970 15971 7ff75c2c6d60 92 API calls 15969->15971 16213 7ff75c2c7240 15970->16213 15976 7ff75c2c2b5c __vcrt_freefls 15971->15976 15973 7ff75c2c2b9c 16217 7ff75c2c1cb0 15973->16217 15976->15970 15979 7ff75c2c7240 89 API calls 15976->15979 15977 7ff75c2c1cb0 121 API calls 15978 7ff75c2c2bca 15977->15978 15980 7ff75c2c2c15 15978->15980 15981 7ff75c2c2bce 15978->15981 15979->15970 15982 7ff75c2c2c8e 15980->15982 16324 7ff75c2c31a0 15980->16324 16318 7ff75c2c2010 15981->16318 15983 7ff75c2c2cd7 15982->15983 15990 7ff75c2c2cbf 15982->15990 15991 7ff75c2c2cb8 15982->15991 15985 7ff75c2c2cfb 15983->15985 16236 7ff75c2c14f0 15983->16236 15985->15963 15988 7ff75c2c2d56 15985->15988 16243 7ff75c2c7fb0 15985->16243 16257 7ff75c2c5fe0 15988->16257 15990->15983 16003 7ff75c2c2cd2 15990->16003 16347 7ff75c2c7ab0 GetConsoleWindow 15991->16347 15994 7ff75c2c2c33 16004 7ff75c2c2010 86 API calls 15994->16004 15996 7ff75c2c2d33 16000 7ff75c2c2d49 SetDllDirectoryW 15996->16000 16001 7ff75c2c2d38 15996->16001 16000->15988 16002 7ff75c2c2010 86 API calls 16001->16002 16002->15963 16352 7ff75c2c7c00 GetConsoleWindow 16003->16352 16004->15963 16005 7ff75c2c2c61 16005->15982 16006 7ff75c2c2c66 16005->16006 16343 7ff75c2cf64c 16006->16343 16010 7ff75c2c2d70 16031 7ff75c2c2da2 16010->16031 16366 7ff75c2c57f0 16010->16366 16011 7ff75c2c2e9d 16261 7ff75c2c26d0 16011->16261 16016 7ff75c2c2dc1 16024 7ff75c2c2e05 16016->16024 16402 7ff75c2c1ef0 16016->16402 16017 7ff75c2c2da4 16019 7ff75c2c5a40 FreeLibrary 16017->16019 16018 7ff75c2c2e68 16406 7ff75c2c2670 16018->16406 16019->16031 16023 7ff75c2c2ec5 16026 7ff75c2c6d60 92 API calls 16023->16026 16024->15963 16024->16018 16029 7ff75c2c2e49 16024->16029 16035 7ff75c2c2e50 16024->16035 16041 7ff75c2c2ed1 16026->16041 16032 7ff75c2c7ab0 4 API calls 16029->16032 16031->16011 16031->16016 16034 7ff75c2c2e4e 16032->16034 16033 7ff75c2c2e78 16038 7ff75c2c5a40 FreeLibrary 16033->16038 16034->16018 16035->16018 16037 7ff75c2c2e63 16035->16037 16036 7ff75c2c2f0d 16275 7ff75c2c7280 16036->16275 16039 7ff75c2c7c00 4 API calls 16037->16039 16038->15963 16039->16018 16041->16036 16043 7ff75c2c2ef5 16041->16043 16044 7ff75c2c2eee 16041->16044 16043->16036 16048 7ff75c2c2f08 16043->16048 16046 7ff75c2c7ab0 4 API calls 16044->16046 16047 7ff75c2c2ef3 16046->16047 16047->16036 16050 7ff75c2c7c00 4 API calls 16048->16050 16050->16036 16053 7ff75c2da3b4 16052->16053 16054 7ff75c2da393 16052->16054 16055 7ff75c2dac28 45 API calls 16053->16055 16054->15930 16056 7ff75c2da3b9 16055->16056 16058 7ff75c2cbbc1 16057->16058 16058->15938 16060 7ff75c2cb8d1 16059->16060 16061 7ff75c2cb676 16060->16061 16062 7ff75c2cce58 __scrt_initialize_crt 7 API calls 16060->16062 16061->15928 16062->16061 16064 7ff75c2cba82 _wfindfirst32i64 memcpy_s 16063->16064 16065 7ff75c2cbaa1 RtlCaptureContext RtlLookupFunctionEntry 16064->16065 16066 7ff75c2cbb06 memcpy_s 16065->16066 16067 7ff75c2cbaca RtlVirtualUnwind 16065->16067 16068 7ff75c2cbb38 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16066->16068 16067->16066 16069 7ff75c2cbb8a _wfindfirst32i64 16068->16069 16069->15926 16071 7ff75c2cb74e __scrt_dllmain_crt_thread_attach 16070->16071 16071->15944 16071->15945 16073 7ff75c2e3d0c 16072->16073 16074 7ff75c2cb760 16073->16074 16082 7ff75c2dcda0 16073->16082 16074->15945 16076 7ff75c2cce58 16074->16076 16077 7ff75c2cce60 16076->16077 16078 7ff75c2cce6a 16076->16078 16094 7ff75c2cd1d4 16077->16094 16078->15945 16093 7ff75c2e0ea8 EnterCriticalSection 16082->16093 16095 7ff75c2cd1e3 16094->16095 16096 7ff75c2cce65 16094->16096 16102 7ff75c2cd410 16095->16102 16098 7ff75c2cd240 16096->16098 16099 7ff75c2cd26b 16098->16099 16100 7ff75c2cd26f 16099->16100 16101 7ff75c2cd24e DeleteCriticalSection 16099->16101 16100->16078 16101->16099 16106 7ff75c2cd278 16102->16106 16107 7ff75c2cd392 TlsFree 16106->16107 16113 7ff75c2cd2bc __vcrt_InitializeCriticalSectionEx 16106->16113 16108 7ff75c2cd2ea LoadLibraryExW 16110 7ff75c2cd361 16108->16110 16111 7ff75c2cd30b GetLastError 16108->16111 16109 7ff75c2cd381 GetProcAddress 16109->16107 16110->16109 16112 7ff75c2cd378 FreeLibrary 16110->16112 16111->16113 16112->16109 16113->16107 16113->16108 16113->16109 16114 7ff75c2cd32d LoadLibraryExW 16113->16114 16114->16110 16114->16113 16116 7ff75c2d9a75 16115->16116 16117 7ff75c2d9a79 16115->16117 16116->15950 16128 7ff75c2d9e20 16116->16128 16136 7ff75c2e329c GetEnvironmentStringsW 16117->16136 16120 7ff75c2d9a86 16122 7ff75c2db1cc __free_lconv_num 11 API calls 16120->16122 16121 7ff75c2d9a92 16143 7ff75c2d9be0 16121->16143 16122->16116 16125 7ff75c2db1cc __free_lconv_num 11 API calls 16126 7ff75c2d9ab9 16125->16126 16127 7ff75c2db1cc __free_lconv_num 11 API calls 16126->16127 16127->16116 16129 7ff75c2d9e43 16128->16129 16130 7ff75c2d9e5a 16128->16130 16129->15950 16130->16129 16131 7ff75c2df430 _findclose 11 API calls 16130->16131 16132 7ff75c2d9ece 16130->16132 16133 7ff75c2dfdf0 MultiByteToWideChar _fread_nolock 16130->16133 16135 7ff75c2db1cc __free_lconv_num 11 API calls 16130->16135 16131->16130 16134 7ff75c2db1cc __free_lconv_num 11 API calls 16132->16134 16133->16130 16134->16129 16135->16130 16137 7ff75c2d9a7e 16136->16137 16138 7ff75c2e32c0 16136->16138 16137->16120 16137->16121 16139 7ff75c2dde7c _fread_nolock 12 API calls 16138->16139 16140 7ff75c2e32f7 memcpy_s 16139->16140 16141 7ff75c2db1cc __free_lconv_num 11 API calls 16140->16141 16142 7ff75c2e3317 FreeEnvironmentStringsW 16141->16142 16142->16137 16144 7ff75c2d9c08 16143->16144 16145 7ff75c2df430 _findclose 11 API calls 16144->16145 16156 7ff75c2d9c43 16145->16156 16146 7ff75c2d9c4b 16147 7ff75c2db1cc __free_lconv_num 11 API calls 16146->16147 16148 7ff75c2d9a9a 16147->16148 16148->16125 16149 7ff75c2d9cc5 16150 7ff75c2db1cc __free_lconv_num 11 API calls 16149->16150 16150->16148 16151 7ff75c2df430 _findclose 11 API calls 16151->16156 16152 7ff75c2d9cb4 16162 7ff75c2d9cfc 16152->16162 16153 7ff75c2e1044 _wfindfirst32i64 37 API calls 16153->16156 16156->16146 16156->16149 16156->16151 16156->16152 16156->16153 16157 7ff75c2d9ce8 16156->16157 16160 7ff75c2db1cc __free_lconv_num 11 API calls 16156->16160 16159 7ff75c2db184 _wfindfirst32i64 17 API calls 16157->16159 16158 7ff75c2db1cc __free_lconv_num 11 API calls 16158->16146 16161 7ff75c2d9cfa 16159->16161 16160->16156 16163 7ff75c2d9cbc 16162->16163 16164 7ff75c2d9d01 16162->16164 16163->16158 16165 7ff75c2d9d2a 16164->16165 16167 7ff75c2db1cc __free_lconv_num 11 API calls 16164->16167 16166 7ff75c2db1cc __free_lconv_num 11 API calls 16165->16166 16166->16163 16167->16164 16170 7ff75c2c792f 16168->16170 16169 7ff75c2c7937 __vcrt_freefls 16169->15958 16170->16169 16171 7ff75c2c7980 WideCharToMultiByte 16170->16171 16172 7ff75c2c7a26 16170->16172 16173 7ff75c2c79d4 WideCharToMultiByte 16170->16173 16171->16170 16171->16172 16433 7ff75c2c2070 16172->16433 16173->16170 16173->16172 16178 7ff75c2e0240 16175->16178 16176 7ff75c2e0293 16177 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16176->16177 16181 7ff75c2e02bc 16177->16181 16178->16176 16179 7ff75c2e02e6 16178->16179 16761 7ff75c2e0118 16179->16761 16181->15960 16183 7ff75c2c1ec5 16182->16183 16184 7ff75c2c1ee0 16183->16184 16769 7ff75c2c1fd0 16183->16769 16184->15963 16186 7ff75c2c3090 16184->16186 16792 7ff75c2cb130 16186->16792 16189 7ff75c2c30e2 16794 7ff75c2c80c0 16189->16794 16190 7ff75c2c30cb 16191 7ff75c2c2070 86 API calls 16190->16191 16196 7ff75c2c30de 16191->16196 16194 7ff75c2c2010 86 API calls 16194->16196 16195 7ff75c2cb190 _wfindfirst32i64 8 API calls 16197 7ff75c2c311f 16195->16197 16196->16195 16197->15967 16199 7ff75c2c6d6a 16198->16199 16200 7ff75c2c7fb0 88 API calls 16199->16200 16201 7ff75c2c6d8c GetEnvironmentVariableW 16200->16201 16202 7ff75c2c6df6 16201->16202 16203 7ff75c2c6da4 ExpandEnvironmentStringsW 16201->16203 16204 7ff75c2cb190 _wfindfirst32i64 8 API calls 16202->16204 16205 7ff75c2c80c0 88 API calls 16203->16205 16206 7ff75c2c6e08 16204->16206 16207 7ff75c2c6dcc 16205->16207 16206->15969 16207->16202 16208 7ff75c2c6dd6 16207->16208 16805 7ff75c2dac5c 16208->16805 16211 7ff75c2cb190 _wfindfirst32i64 8 API calls 16212 7ff75c2c6dee 16211->16212 16212->15969 16214 7ff75c2c7fb0 88 API calls 16213->16214 16215 7ff75c2c7257 SetEnvironmentVariableW 16214->16215 16216 7ff75c2c726f __vcrt_freefls 16215->16216 16216->15973 16218 7ff75c2c1cbe 16217->16218 16219 7ff75c2c1ef0 49 API calls 16218->16219 16220 7ff75c2c1cf4 16219->16220 16221 7ff75c2c1dde 16220->16221 16222 7ff75c2c1ef0 49 API calls 16220->16222 16224 7ff75c2cb190 _wfindfirst32i64 8 API calls 16221->16224 16223 7ff75c2c1d1a 16222->16223 16223->16221 16812 7ff75c2c1aa0 16223->16812 16225 7ff75c2c1e6c 16224->16225 16225->15977 16225->15982 16229 7ff75c2c1dcc 16230 7ff75c2c3010 49 API calls 16229->16230 16230->16221 16231 7ff75c2c1d8f 16231->16229 16232 7ff75c2c1e34 16231->16232 16233 7ff75c2c3010 49 API calls 16232->16233 16234 7ff75c2c1e41 16233->16234 16848 7ff75c2c3220 16234->16848 16237 7ff75c2c157f 16236->16237 16239 7ff75c2c1506 16236->16239 16237->15985 16890 7ff75c2c6b50 16239->16890 16241 7ff75c2c2010 86 API calls 16242 7ff75c2c1564 16241->16242 16242->15985 16244 7ff75c2c7fd1 MultiByteToWideChar 16243->16244 16245 7ff75c2c8057 MultiByteToWideChar 16243->16245 16248 7ff75c2c7ff7 16244->16248 16251 7ff75c2c801c 16244->16251 16246 7ff75c2c809f 16245->16246 16247 7ff75c2c807a 16245->16247 16246->15996 16249 7ff75c2c2070 86 API calls 16247->16249 16250 7ff75c2c2070 86 API calls 16248->16250 16252 7ff75c2c808d 16249->16252 16253 7ff75c2c800a 16250->16253 16251->16245 16254 7ff75c2c8032 16251->16254 16252->15996 16253->15996 16255 7ff75c2c2070 86 API calls 16254->16255 16256 7ff75c2c8045 16255->16256 16256->15996 16258 7ff75c2c5ff5 16257->16258 16259 7ff75c2c2d5b 16258->16259 16260 7ff75c2c1fd0 86 API calls 16258->16260 16259->16031 16357 7ff75c2c5c90 16259->16357 16260->16259 16265 7ff75c2c2743 16261->16265 16267 7ff75c2c2784 16261->16267 16262 7ff75c2cb190 _wfindfirst32i64 8 API calls 16263 7ff75c2c27d5 16262->16263 16263->15963 16268 7ff75c2c71d0 16263->16268 16265->16267 17424 7ff75c2c1710 16265->17424 17466 7ff75c2c2190 16265->17466 16267->16262 16269 7ff75c2c7fb0 88 API calls 16268->16269 16270 7ff75c2c71ef 16269->16270 16271 7ff75c2c7fb0 88 API calls 16270->16271 16272 7ff75c2c71ff 16271->16272 16273 7ff75c2d80b0 38 API calls 16272->16273 16274 7ff75c2c720d __vcrt_freefls 16273->16274 16274->16023 16276 7ff75c2c7290 16275->16276 16277 7ff75c2c7fb0 88 API calls 16276->16277 16319 7ff75c2c202e 16318->16319 16320 7ff75c2c1f50 78 API calls 16319->16320 16321 7ff75c2c204c 16320->16321 16322 7ff75c2c20c0 86 API calls 16321->16322 16323 7ff75c2c205b 16322->16323 16323->15963 16325 7ff75c2c31ac 16324->16325 16326 7ff75c2c7fb0 88 API calls 16325->16326 16327 7ff75c2c31d7 16326->16327 16328 7ff75c2c7fb0 88 API calls 16327->16328 16329 7ff75c2c31ea 16328->16329 18005 7ff75c2d66f8 16329->18005 16332 7ff75c2cb190 _wfindfirst32i64 8 API calls 16333 7ff75c2c2c2b 16332->16333 16333->15994 16334 7ff75c2c74b0 16333->16334 16335 7ff75c2c74d4 16334->16335 16336 7ff75c2cfcd4 73 API calls 16335->16336 16341 7ff75c2c75ab __vcrt_freefls 16335->16341 16337 7ff75c2c74ee 16336->16337 16337->16341 18384 7ff75c2d9334 16337->18384 16341->16005 16344 7ff75c2cf67c 16343->16344 18399 7ff75c2cf428 16344->18399 16348 7ff75c2c7ac4 GetCurrentProcessId GetWindowThreadProcessId 16347->16348 16349 7ff75c2c2cbd 16347->16349 16348->16349 16350 7ff75c2c7ae3 16348->16350 16349->15983 16350->16349 16351 7ff75c2c7ae9 ShowWindow 16350->16351 16351->16349 16353 7ff75c2c7c14 GetCurrentProcessId GetWindowThreadProcessId 16352->16353 16354 7ff75c2c7c47 16352->16354 16353->16354 16355 7ff75c2c7c33 16353->16355 16354->15983 16355->16354 16356 7ff75c2c7c39 ShowWindow 16355->16356 16356->16354 16358 7ff75c2c5cb3 16357->16358 16359 7ff75c2c5cca 16357->16359 16358->16359 18410 7ff75c2c15a0 16358->18410 16359->16010 16361 7ff75c2c5cd4 16361->16359 16362 7ff75c2c3220 49 API calls 16361->16362 16364 7ff75c2c5d35 16362->16364 16363 7ff75c2c2010 86 API calls 16363->16359 16364->16363 16365 7ff75c2c5da5 memcpy_s __vcrt_freefls 16364->16365 16365->16010 16376 7ff75c2c580a memcpy_s 16366->16376 16368 7ff75c2c592f 16370 7ff75c2c3220 49 API calls 16368->16370 16369 7ff75c2c594b 16372 7ff75c2c2010 86 API calls 16369->16372 16371 7ff75c2c59a8 16370->16371 16375 7ff75c2c3220 49 API calls 16371->16375 16379 7ff75c2c5941 __vcrt_freefls 16372->16379 16373 7ff75c2c3220 49 API calls 16373->16376 16374 7ff75c2c5910 16374->16368 16377 7ff75c2c3220 49 API calls 16374->16377 16378 7ff75c2c59d8 16375->16378 16376->16368 16376->16369 16376->16373 16376->16374 16376->16376 16383 7ff75c2c1710 140 API calls 16376->16383 16384 7ff75c2c5931 16376->16384 18434 7ff75c2c1950 16376->18434 16377->16368 16382 7ff75c2c3220 49 API calls 16378->16382 16380 7ff75c2cb190 _wfindfirst32i64 8 API calls 16379->16380 16381 7ff75c2c2d81 16380->16381 16381->16017 16386 7ff75c2c5770 16381->16386 16382->16379 16383->16376 16385 7ff75c2c2010 86 API calls 16384->16385 16385->16379 18438 7ff75c2c7460 16386->18438 16388 7ff75c2c578c 16389 7ff75c2c7460 89 API calls 16388->16389 16390 7ff75c2c579f 16389->16390 16391 7ff75c2c57d5 16390->16391 16392 7ff75c2c57b7 16390->16392 16393 7ff75c2c2010 86 API calls 16391->16393 18442 7ff75c2c60f0 GetProcAddress 16392->18442 16403 7ff75c2c1f15 16402->16403 16404 7ff75c2d4cc0 49 API calls 16403->16404 16405 7ff75c2c1f38 16404->16405 16405->16024 18501 7ff75c2c4dc0 16406->18501 16409 7ff75c2c26bd 16409->16033 16440 7ff75c2c20c0 16433->16440 16441 7ff75c2c20d0 16440->16441 16465 7ff75c2d4cc0 16441->16465 16445 7ff75c2c2130 16498 7ff75c2c1f50 16445->16498 16448 7ff75c2cb190 _wfindfirst32i64 8 API calls 16449 7ff75c2c2097 GetLastError 16448->16449 16450 7ff75c2c77c0 16449->16450 16451 7ff75c2c77cc 16450->16451 16452 7ff75c2c77e7 GetLastError 16451->16452 16453 7ff75c2c77ed FormatMessageW 16451->16453 16452->16453 16454 7ff75c2c7820 16453->16454 16455 7ff75c2c783c WideCharToMultiByte 16453->16455 16456 7ff75c2c2070 83 API calls 16454->16456 16457 7ff75c2c7833 16455->16457 16458 7ff75c2c7876 16455->16458 16456->16457 16460 7ff75c2cb190 _wfindfirst32i64 8 API calls 16457->16460 16459 7ff75c2c2070 83 API calls 16458->16459 16459->16457 16461 7ff75c2c20a4 16460->16461 16462 7ff75c2c1fa0 16461->16462 16463 7ff75c2c20c0 86 API calls 16462->16463 16464 7ff75c2c1fc2 16463->16464 16464->16169 16468 7ff75c2d4d1a 16465->16468 16466 7ff75c2d4d3f 16467 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16466->16467 16471 7ff75c2d4d69 16467->16471 16468->16466 16469 7ff75c2d4d7b 16468->16469 16502 7ff75c2d2704 16469->16502 16473 7ff75c2cb190 _wfindfirst32i64 8 API calls 16471->16473 16472 7ff75c2d4e58 16474 7ff75c2db1cc __free_lconv_num 11 API calls 16472->16474 16476 7ff75c2c2118 16473->16476 16474->16471 16483 7ff75c2c7df0 MultiByteToWideChar 16476->16483 16477 7ff75c2d4e7c 16477->16472 16478 7ff75c2d4e86 16477->16478 16481 7ff75c2db1cc __free_lconv_num 11 API calls 16478->16481 16479 7ff75c2db1cc __free_lconv_num 11 API calls 16479->16471 16480 7ff75c2d4e24 16480->16472 16482 7ff75c2d4e2d 16480->16482 16481->16471 16482->16479 16484 7ff75c2c7e56 16483->16484 16485 7ff75c2c7e3c 16483->16485 16487 7ff75c2c7e85 MultiByteToWideChar 16484->16487 16488 7ff75c2c7e6b 16484->16488 16486 7ff75c2c2070 82 API calls 16485->16486 16497 7ff75c2c7e4f __vcrt_freefls 16486->16497 16490 7ff75c2c7ec2 WideCharToMultiByte 16487->16490 16491 7ff75c2c7ea8 16487->16491 16489 7ff75c2c2070 82 API calls 16488->16489 16489->16497 16493 7ff75c2c7ef8 16490->16493 16495 7ff75c2c7eef 16490->16495 16492 7ff75c2c2070 82 API calls 16491->16492 16492->16497 16494 7ff75c2c7f1d WideCharToMultiByte 16493->16494 16493->16495 16494->16495 16494->16497 16496 7ff75c2c2070 82 API calls 16495->16496 16496->16497 16497->16445 16499 7ff75c2c1f76 16498->16499 16746 7ff75c2d4b9c 16499->16746 16501 7ff75c2c1f8c 16501->16448 16503 7ff75c2d2742 16502->16503 16504 7ff75c2d2732 16502->16504 16505 7ff75c2d274b 16503->16505 16514 7ff75c2d2779 16503->16514 16506 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16504->16506 16507 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16505->16507 16508 7ff75c2d2771 16506->16508 16507->16508 16508->16472 16508->16477 16508->16480 16508->16482 16511 7ff75c2d2a28 16513 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16511->16513 16513->16504 16514->16504 16514->16508 16514->16511 16516 7ff75c2d3654 16514->16516 16542 7ff75c2d2ee4 16514->16542 16572 7ff75c2d224c 16514->16572 16575 7ff75c2d4870 16514->16575 16517 7ff75c2d3696 16516->16517 16518 7ff75c2d3709 16516->16518 16519 7ff75c2d3733 16517->16519 16520 7ff75c2d369c 16517->16520 16521 7ff75c2d3763 16518->16521 16522 7ff75c2d370e 16518->16522 16599 7ff75c2d1190 16519->16599 16527 7ff75c2d36a1 16520->16527 16530 7ff75c2d3772 16520->16530 16521->16519 16521->16530 16540 7ff75c2d36cc 16521->16540 16523 7ff75c2d3743 16522->16523 16524 7ff75c2d3710 16522->16524 16606 7ff75c2d0d80 16523->16606 16526 7ff75c2d36b1 16524->16526 16533 7ff75c2d371f 16524->16533 16541 7ff75c2d37a1 16526->16541 16581 7ff75c2d3fb8 16526->16581 16527->16526 16531 7ff75c2d36e4 16527->16531 16527->16540 16530->16541 16613 7ff75c2d15a0 16530->16613 16531->16541 16591 7ff75c2d4474 16531->16591 16533->16519 16535 7ff75c2d3724 16533->16535 16535->16541 16595 7ff75c2d460c 16535->16595 16536 7ff75c2cb190 _wfindfirst32i64 8 API calls 16538 7ff75c2d3a37 16536->16538 16538->16514 16540->16541 16620 7ff75c2df0d8 16540->16620 16541->16536 16543 7ff75c2d2f05 16542->16543 16544 7ff75c2d2eef 16542->16544 16547 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16543->16547 16548 7ff75c2d2f43 16543->16548 16545 7ff75c2d3696 16544->16545 16546 7ff75c2d3709 16544->16546 16544->16548 16549 7ff75c2d3733 16545->16549 16550 7ff75c2d369c 16545->16550 16551 7ff75c2d3763 16546->16551 16552 7ff75c2d370e 16546->16552 16547->16548 16548->16514 16555 7ff75c2d1190 38 API calls 16549->16555 16557 7ff75c2d36a1 16550->16557 16560 7ff75c2d3772 16550->16560 16551->16549 16551->16560 16570 7ff75c2d36cc 16551->16570 16553 7ff75c2d3743 16552->16553 16554 7ff75c2d3710 16552->16554 16558 7ff75c2d0d80 38 API calls 16553->16558 16556 7ff75c2d36b1 16554->16556 16563 7ff75c2d371f 16554->16563 16555->16570 16559 7ff75c2d3fb8 47 API calls 16556->16559 16571 7ff75c2d37a1 16556->16571 16557->16556 16561 7ff75c2d36e4 16557->16561 16557->16570 16558->16570 16559->16570 16562 7ff75c2d15a0 38 API calls 16560->16562 16560->16571 16564 7ff75c2d4474 47 API calls 16561->16564 16561->16571 16562->16570 16563->16549 16565 7ff75c2d3724 16563->16565 16564->16570 16567 7ff75c2d460c 37 API calls 16565->16567 16565->16571 16566 7ff75c2cb190 _wfindfirst32i64 8 API calls 16568 7ff75c2d3a37 16566->16568 16567->16570 16568->16514 16569 7ff75c2df0d8 47 API calls 16569->16570 16570->16569 16570->16571 16571->16566 16705 7ff75c2d0354 16572->16705 16576 7ff75c2d4887 16575->16576 16722 7ff75c2de238 16576->16722 16582 7ff75c2d3fda 16581->16582 16630 7ff75c2d01c0 16582->16630 16587 7ff75c2d4870 45 API calls 16590 7ff75c2d4117 16587->16590 16588 7ff75c2d4870 45 API calls 16589 7ff75c2d41a0 16588->16589 16589->16540 16590->16588 16590->16589 16590->16590 16592 7ff75c2d448c 16591->16592 16594 7ff75c2d44f4 16591->16594 16593 7ff75c2df0d8 47 API calls 16592->16593 16592->16594 16593->16594 16594->16540 16598 7ff75c2d462d 16595->16598 16596 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16597 7ff75c2d465e 16596->16597 16597->16540 16598->16596 16598->16597 16600 7ff75c2d11c3 16599->16600 16601 7ff75c2d11f2 16600->16601 16603 7ff75c2d12af 16600->16603 16602 7ff75c2d01c0 12 API calls 16601->16602 16605 7ff75c2d122f 16601->16605 16602->16605 16604 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16603->16604 16604->16605 16605->16540 16608 7ff75c2d0db3 16606->16608 16607 7ff75c2d0de2 16609 7ff75c2d01c0 12 API calls 16607->16609 16612 7ff75c2d0e1f 16607->16612 16608->16607 16610 7ff75c2d0e9f 16608->16610 16609->16612 16611 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16610->16611 16611->16612 16612->16540 16614 7ff75c2d15d3 16613->16614 16615 7ff75c2d1602 16614->16615 16617 7ff75c2d16bf 16614->16617 16616 7ff75c2d01c0 12 API calls 16615->16616 16619 7ff75c2d163f 16615->16619 16616->16619 16618 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16617->16618 16618->16619 16619->16540 16622 7ff75c2df100 16620->16622 16621 7ff75c2df145 16625 7ff75c2df105 memcpy_s 16621->16625 16626 7ff75c2df12e memcpy_s 16621->16626 16702 7ff75c2e06b8 16621->16702 16622->16621 16624 7ff75c2d4870 45 API calls 16622->16624 16622->16625 16622->16626 16623 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16623->16625 16624->16621 16625->16540 16626->16623 16626->16625 16631 7ff75c2d01f7 16630->16631 16637 7ff75c2d01e6 16630->16637 16632 7ff75c2dde7c _fread_nolock 12 API calls 16631->16632 16631->16637 16633 7ff75c2d0224 16632->16633 16634 7ff75c2d0238 16633->16634 16635 7ff75c2db1cc __free_lconv_num 11 API calls 16633->16635 16636 7ff75c2db1cc __free_lconv_num 11 API calls 16634->16636 16635->16634 16636->16637 16638 7ff75c2dedf0 16637->16638 16639 7ff75c2dee40 16638->16639 16640 7ff75c2dee0d 16638->16640 16639->16640 16642 7ff75c2dee72 16639->16642 16641 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16640->16641 16651 7ff75c2d40f5 16641->16651 16648 7ff75c2def85 16642->16648 16653 7ff75c2deeba 16642->16653 16643 7ff75c2df077 16693 7ff75c2de2dc 16643->16693 16645 7ff75c2df03d 16686 7ff75c2de674 16645->16686 16647 7ff75c2df00c 16679 7ff75c2de954 16647->16679 16648->16643 16648->16645 16648->16647 16650 7ff75c2defcf 16648->16650 16652 7ff75c2defc5 16648->16652 16669 7ff75c2deb84 16650->16669 16651->16587 16651->16590 16652->16645 16655 7ff75c2defca 16652->16655 16653->16651 16660 7ff75c2dacfc 16653->16660 16655->16647 16655->16650 16658 7ff75c2db184 _wfindfirst32i64 17 API calls 16659 7ff75c2df0d4 16658->16659 16661 7ff75c2dad09 16660->16661 16663 7ff75c2dad13 16660->16663 16661->16663 16667 7ff75c2dad2e 16661->16667 16662 7ff75c2d7c48 _findclose 11 API calls 16664 7ff75c2dad1a 16662->16664 16663->16662 16665 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 16664->16665 16666 7ff75c2dad26 16665->16666 16666->16651 16666->16658 16667->16666 16668 7ff75c2d7c48 _findclose 11 API calls 16667->16668 16668->16664 16670 7ff75c2e490c 38 API calls 16669->16670 16671 7ff75c2debd1 16670->16671 16672 7ff75c2e4354 37 API calls 16671->16672 16673 7ff75c2dec2c 16672->16673 16674 7ff75c2dec30 16673->16674 16675 7ff75c2dec81 16673->16675 16676 7ff75c2dec4c 16673->16676 16674->16651 16677 7ff75c2de770 45 API calls 16675->16677 16678 7ff75c2dea2c 45 API calls 16676->16678 16677->16674 16678->16674 16680 7ff75c2e490c 38 API calls 16679->16680 16681 7ff75c2de99e 16680->16681 16682 7ff75c2e4354 37 API calls 16681->16682 16683 7ff75c2de9ee 16682->16683 16684 7ff75c2de9f2 16683->16684 16685 7ff75c2dea2c 45 API calls 16683->16685 16684->16651 16685->16684 16687 7ff75c2e490c 38 API calls 16686->16687 16688 7ff75c2de6bf 16687->16688 16689 7ff75c2e4354 37 API calls 16688->16689 16690 7ff75c2de717 16689->16690 16691 7ff75c2de71b 16690->16691 16692 7ff75c2de770 45 API calls 16690->16692 16691->16651 16692->16691 16694 7ff75c2de354 16693->16694 16695 7ff75c2de321 16693->16695 16697 7ff75c2de36c 16694->16697 16699 7ff75c2de3ed 16694->16699 16696 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16695->16696 16701 7ff75c2de34d memcpy_s 16696->16701 16698 7ff75c2de674 46 API calls 16697->16698 16698->16701 16700 7ff75c2d4870 45 API calls 16699->16700 16699->16701 16700->16701 16701->16651 16703 7ff75c2e06dc WideCharToMultiByte 16702->16703 16706 7ff75c2d0381 16705->16706 16708 7ff75c2d0393 16705->16708 16707 7ff75c2d7c48 _findclose 11 API calls 16706->16707 16709 7ff75c2d0386 16707->16709 16710 7ff75c2d03a0 16708->16710 16713 7ff75c2d03dd 16708->16713 16711 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 16709->16711 16712 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16710->16712 16718 7ff75c2d0391 16711->16718 16712->16718 16714 7ff75c2d0486 16713->16714 16716 7ff75c2d7c48 _findclose 11 API calls 16713->16716 16715 7ff75c2d7c48 _findclose 11 API calls 16714->16715 16714->16718 16717 7ff75c2d0530 16715->16717 16719 7ff75c2d047b 16716->16719 16720 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 16717->16720 16718->16514 16721 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 16719->16721 16720->16718 16721->16714 16723 7ff75c2de251 16722->16723 16724 7ff75c2d48af 16722->16724 16723->16724 16730 7ff75c2e3b64 16723->16730 16726 7ff75c2de2a4 16724->16726 16727 7ff75c2de2bd 16726->16727 16729 7ff75c2d48bf 16726->16729 16727->16729 16743 7ff75c2e2eb0 16727->16743 16729->16514 16731 7ff75c2db9d0 __CxxCallCatchBlock 45 API calls 16730->16731 16732 7ff75c2e3b73 16731->16732 16733 7ff75c2e3bbe 16732->16733 16742 7ff75c2e0ea8 EnterCriticalSection 16732->16742 16733->16724 16744 7ff75c2db9d0 __CxxCallCatchBlock 45 API calls 16743->16744 16745 7ff75c2e2eb9 16744->16745 16747 7ff75c2d4bc6 16746->16747 16748 7ff75c2d4bfe 16747->16748 16750 7ff75c2d4c31 16747->16750 16749 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16748->16749 16752 7ff75c2d4c27 16749->16752 16753 7ff75c2d0180 16750->16753 16752->16501 16760 7ff75c2d556c EnterCriticalSection 16753->16760 16768 7ff75c2d556c EnterCriticalSection 16761->16768 16770 7ff75c2c20c0 86 API calls 16769->16770 16771 7ff75c2c1ff7 16770->16771 16774 7ff75c2d56c0 16771->16774 16775 7ff75c2d56eb 16774->16775 16778 7ff75c2d5584 16775->16778 16791 7ff75c2d85e8 EnterCriticalSection 16778->16791 16793 7ff75c2c309c GetModuleFileNameW 16792->16793 16793->16189 16793->16190 16795 7ff75c2c80e4 WideCharToMultiByte 16794->16795 16796 7ff75c2c8152 WideCharToMultiByte 16794->16796 16798 7ff75c2c8125 16795->16798 16799 7ff75c2c810e 16795->16799 16797 7ff75c2c817f 16796->16797 16802 7ff75c2c30f5 16796->16802 16800 7ff75c2c2070 86 API calls 16797->16800 16798->16796 16803 7ff75c2c813b 16798->16803 16801 7ff75c2c2070 86 API calls 16799->16801 16800->16802 16801->16802 16802->16194 16802->16196 16804 7ff75c2c2070 86 API calls 16803->16804 16804->16802 16806 7ff75c2dac73 16805->16806 16808 7ff75c2c6dde 16805->16808 16807 7ff75c2dacfc __std_exception_copy 37 API calls 16806->16807 16806->16808 16809 7ff75c2daca0 16807->16809 16808->16211 16809->16808 16810 7ff75c2db184 _wfindfirst32i64 17 API calls 16809->16810 16811 7ff75c2dacd0 16810->16811 16813 7ff75c2c31a0 120 API calls 16812->16813 16814 7ff75c2c1ad6 16813->16814 16815 7ff75c2c1c84 16814->16815 16817 7ff75c2c74b0 83 API calls 16814->16817 16816 7ff75c2cb190 _wfindfirst32i64 8 API calls 16815->16816 16818 7ff75c2c1c98 16816->16818 16819 7ff75c2c1b0e 16817->16819 16818->16221 16845 7ff75c2c3010 16818->16845 16843 7ff75c2c1b3f 16819->16843 16851 7ff75c2cfcd4 16819->16851 16820 7ff75c2cf64c 74 API calls 16820->16815 16822 7ff75c2c1b28 16823 7ff75c2c1b44 16822->16823 16824 7ff75c2c1b2c 16822->16824 16855 7ff75c2cf99c 16823->16855 16826 7ff75c2c1fd0 86 API calls 16824->16826 16826->16843 16828 7ff75c2c1b5f 16830 7ff75c2c1fd0 86 API calls 16828->16830 16829 7ff75c2c1b77 16831 7ff75c2cfcd4 73 API calls 16829->16831 16830->16843 16832 7ff75c2c1bc4 16831->16832 16833 7ff75c2c1bd6 16832->16833 16834 7ff75c2c1bee 16832->16834 16836 7ff75c2c1fd0 86 API calls 16833->16836 16835 7ff75c2cf99c _fread_nolock 53 API calls 16834->16835 16837 7ff75c2c1c03 16835->16837 16836->16843 16838 7ff75c2c1c09 16837->16838 16839 7ff75c2c1c1e 16837->16839 16840 7ff75c2c1fd0 86 API calls 16838->16840 16858 7ff75c2cf710 16839->16858 16840->16843 16843->16820 16844 7ff75c2c2010 86 API calls 16844->16843 16846 7ff75c2c1ef0 49 API calls 16845->16846 16847 7ff75c2c302d 16846->16847 16847->16231 16849 7ff75c2c1ef0 49 API calls 16848->16849 16850 7ff75c2c3250 16849->16850 16850->16221 16852 7ff75c2cfd04 16851->16852 16864 7ff75c2cfa64 16852->16864 16854 7ff75c2cfd1d 16854->16822 16876 7ff75c2cf9bc 16855->16876 16859 7ff75c2c1c32 16858->16859 16860 7ff75c2cf719 16858->16860 16859->16843 16859->16844 16861 7ff75c2d7c48 _findclose 11 API calls 16860->16861 16862 7ff75c2cf71e 16861->16862 16865 7ff75c2cface 16864->16865 16866 7ff75c2cfa8e 16864->16866 16865->16866 16868 7ff75c2cfada 16865->16868 16867 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16866->16867 16874 7ff75c2cfab5 16867->16874 16875 7ff75c2d556c EnterCriticalSection 16868->16875 16874->16854 16877 7ff75c2c1b59 16876->16877 16878 7ff75c2cf9e6 16876->16878 16877->16828 16877->16829 16878->16877 16879 7ff75c2cf9f5 memcpy_s 16878->16879 16880 7ff75c2cfa32 16878->16880 16882 7ff75c2d7c48 _findclose 11 API calls 16879->16882 16889 7ff75c2d556c EnterCriticalSection 16880->16889 16884 7ff75c2cfa0a 16882->16884 16886 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 16884->16886 16886->16877 16891 7ff75c2c6b66 16890->16891 16892 7ff75c2c6b8a 16891->16892 16893 7ff75c2c6bdd GetTempPathW GetCurrentProcessId 16891->16893 16895 7ff75c2c6d60 92 API calls 16892->16895 16928 7ff75c2c7760 16893->16928 16896 7ff75c2c6b96 16895->16896 16952 7ff75c2c6620 16896->16952 16902 7ff75c2cb190 _wfindfirst32i64 8 API calls 16904 7ff75c2c154f 16902->16904 16903 7ff75c2c6bbc __vcrt_freefls 16903->16893 16908 7ff75c2c6bca 16903->16908 16904->16237 16904->16241 16905 7ff75c2c6c0b __vcrt_freefls 16906 7ff75c2c6cb6 16905->16906 16909 7ff75c2c6c41 16905->16909 16932 7ff75c2d8d68 16905->16932 16935 7ff75c2c7c60 16905->16935 16907 7ff75c2c80c0 88 API calls 16906->16907 16912 7ff75c2c6cc7 __vcrt_freefls 16907->16912 16910 7ff75c2c2010 86 API calls 16908->16910 16913 7ff75c2c7fb0 88 API calls 16909->16913 16921 7ff75c2c6c7a __vcrt_freefls 16909->16921 16914 7ff75c2c7fb0 88 API calls 16912->16914 16912->16921 16915 7ff75c2c6c57 16913->16915 16916 7ff75c2c6ce5 16914->16916 16917 7ff75c2c6c99 SetEnvironmentVariableW 16915->16917 16918 7ff75c2c6c5c 16915->16918 16919 7ff75c2c6cea 16916->16919 16920 7ff75c2c6d1d SetEnvironmentVariableW 16916->16920 16917->16921 16922 7ff75c2c7fb0 88 API calls 16918->16922 16924 7ff75c2c7fb0 88 API calls 16919->16924 16920->16921 16921->16902 16923 7ff75c2c6c6c 16922->16923 16925 7ff75c2d80b0 38 API calls 16923->16925 16926 7ff75c2c6cfa 16924->16926 16925->16921 16927 7ff75c2d80b0 38 API calls 16926->16927 16927->16921 16929 7ff75c2c7785 16928->16929 16986 7ff75c2d4f14 16929->16986 17180 7ff75c2d8994 16932->17180 16936 7ff75c2cb130 16935->16936 16937 7ff75c2c7c70 GetCurrentProcess OpenProcessToken 16936->16937 16938 7ff75c2c7d31 __vcrt_freefls 16937->16938 16939 7ff75c2c7cbb GetTokenInformation 16937->16939 16942 7ff75c2c7d44 FindCloseChangeNotification 16938->16942 16943 7ff75c2c7d4a 16938->16943 16940 7ff75c2c7ce8 16939->16940 16941 7ff75c2c7cdd GetLastError 16939->16941 16940->16938 16944 7ff75c2c7cfe GetTokenInformation 16940->16944 16941->16938 16941->16940 16942->16943 17311 7ff75c2c78b0 16943->17311 16944->16938 16947 7ff75c2c7d24 ConvertSidToStringSidW 16944->16947 16947->16938 16948 7ff75c2c7da6 CreateDirectoryW 16949 7ff75c2c7dbe 16948->16949 16953 7ff75c2c662c 16952->16953 16954 7ff75c2c7fb0 88 API calls 16953->16954 16955 7ff75c2c664e 16954->16955 16956 7ff75c2c6656 16955->16956 16957 7ff75c2c6669 ExpandEnvironmentStringsW 16955->16957 16959 7ff75c2c2010 86 API calls 16956->16959 16958 7ff75c2c668f __vcrt_freefls 16957->16958 16961 7ff75c2c66a6 16958->16961 16962 7ff75c2c6693 16958->16962 16960 7ff75c2c6662 16959->16960 16964 7ff75c2cb190 _wfindfirst32i64 8 API calls 16960->16964 16966 7ff75c2c66c0 16961->16966 16967 7ff75c2c66b4 16961->16967 16963 7ff75c2c2010 86 API calls 16962->16963 16963->16960 16965 7ff75c2c6788 16964->16965 16965->16921 16976 7ff75c2d80b0 16965->16976 17322 7ff75c2d6578 16966->17322 17315 7ff75c2d7c68 16967->17315 16970 7ff75c2c66be 16971 7ff75c2c66da 16970->16971 16974 7ff75c2c66ed memcpy_s 16970->16974 16972 7ff75c2c2010 86 API calls 16971->16972 16972->16960 16973 7ff75c2c6762 CreateDirectoryW 16973->16960 16974->16973 16975 7ff75c2c673c CreateDirectoryW 16974->16975 16975->16974 16977 7ff75c2d80d0 16976->16977 16978 7ff75c2d80bd 16976->16978 17416 7ff75c2d7d34 16977->17416 16979 7ff75c2d7c48 _findclose 11 API calls 16978->16979 16981 7ff75c2d80c2 16979->16981 16983 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 16981->16983 16984 7ff75c2d80ce 16983->16984 16984->16903 16989 7ff75c2d4f6e 16986->16989 16987 7ff75c2d4f93 16990 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 16987->16990 16988 7ff75c2d4fcf 17004 7ff75c2d2a84 16988->17004 16989->16987 16989->16988 16992 7ff75c2d4fbd 16990->16992 16995 7ff75c2cb190 _wfindfirst32i64 8 API calls 16992->16995 16994 7ff75c2db1cc __free_lconv_num 11 API calls 16994->16992 16997 7ff75c2c77a4 16995->16997 16996 7ff75c2d50b0 16996->16994 16997->16905 16998 7ff75c2d5085 17002 7ff75c2db1cc __free_lconv_num 11 API calls 16998->17002 16999 7ff75c2d50d6 16999->16996 17001 7ff75c2d50e0 16999->17001 17000 7ff75c2d507c 17000->16996 17000->16998 17003 7ff75c2db1cc __free_lconv_num 11 API calls 17001->17003 17002->16992 17003->16992 17005 7ff75c2d2ac2 17004->17005 17006 7ff75c2d2ab2 17004->17006 17007 7ff75c2d2acb 17005->17007 17012 7ff75c2d2af9 17005->17012 17009 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17006->17009 17010 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17007->17010 17008 7ff75c2d2af1 17008->16996 17008->16998 17008->16999 17008->17000 17009->17008 17010->17008 17012->17006 17012->17008 17015 7ff75c2d3a58 17012->17015 17048 7ff75c2d306c 17012->17048 17085 7ff75c2d22dc 17012->17085 17016 7ff75c2d3b0b 17015->17016 17017 7ff75c2d3a9a 17015->17017 17020 7ff75c2d3b64 17016->17020 17021 7ff75c2d3b10 17016->17021 17018 7ff75c2d3b35 17017->17018 17019 7ff75c2d3aa0 17017->17019 17104 7ff75c2d1394 17018->17104 17022 7ff75c2d3ad4 17019->17022 17023 7ff75c2d3aa5 17019->17023 17027 7ff75c2d3b7b 17020->17027 17029 7ff75c2d3b6e 17020->17029 17033 7ff75c2d3b73 17020->17033 17024 7ff75c2d3b45 17021->17024 17025 7ff75c2d3b12 17021->17025 17030 7ff75c2d3aab 17022->17030 17022->17033 17023->17027 17023->17030 17111 7ff75c2d0f84 17024->17111 17028 7ff75c2d3ab4 17025->17028 17037 7ff75c2d3b21 17025->17037 17118 7ff75c2d4760 17027->17118 17046 7ff75c2d3ba4 17028->17046 17088 7ff75c2d420c 17028->17088 17029->17018 17029->17033 17030->17028 17036 7ff75c2d3ae6 17030->17036 17044 7ff75c2d3acf 17030->17044 17033->17046 17122 7ff75c2d17a4 17033->17122 17036->17046 17098 7ff75c2d4548 17036->17098 17037->17018 17038 7ff75c2d3b26 17037->17038 17042 7ff75c2d460c 37 API calls 17038->17042 17038->17046 17040 7ff75c2cb190 _wfindfirst32i64 8 API calls 17041 7ff75c2d3e9e 17040->17041 17041->17012 17042->17044 17043 7ff75c2d4870 45 API calls 17047 7ff75c2d3d90 17043->17047 17044->17043 17044->17046 17044->17047 17046->17040 17047->17046 17129 7ff75c2df288 17047->17129 17049 7ff75c2d3090 17048->17049 17050 7ff75c2d307a 17048->17050 17051 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17049->17051 17072 7ff75c2d30d0 17049->17072 17052 7ff75c2d3b0b 17050->17052 17053 7ff75c2d3a9a 17050->17053 17050->17072 17051->17072 17055 7ff75c2d3b10 17052->17055 17060 7ff75c2d3b64 17052->17060 17054 7ff75c2d3aa0 17053->17054 17061 7ff75c2d3b35 17053->17061 17056 7ff75c2d3ad4 17054->17056 17057 7ff75c2d3aa5 17054->17057 17058 7ff75c2d3b45 17055->17058 17059 7ff75c2d3b12 17055->17059 17066 7ff75c2d3aab 17056->17066 17069 7ff75c2d3b73 17056->17069 17063 7ff75c2d3b7b 17057->17063 17057->17066 17067 7ff75c2d0f84 38 API calls 17058->17067 17064 7ff75c2d3ab4 17059->17064 17074 7ff75c2d3b21 17059->17074 17060->17063 17065 7ff75c2d3b6e 17060->17065 17060->17069 17062 7ff75c2d1394 38 API calls 17061->17062 17081 7ff75c2d3acf 17062->17081 17070 7ff75c2d4760 45 API calls 17063->17070 17068 7ff75c2d420c 47 API calls 17064->17068 17084 7ff75c2d3ba4 17064->17084 17065->17061 17065->17069 17066->17064 17071 7ff75c2d3ae6 17066->17071 17066->17081 17067->17081 17068->17081 17073 7ff75c2d17a4 38 API calls 17069->17073 17069->17084 17070->17081 17075 7ff75c2d4548 46 API calls 17071->17075 17071->17084 17072->17012 17073->17081 17074->17061 17076 7ff75c2d3b26 17074->17076 17075->17081 17079 7ff75c2d460c 37 API calls 17076->17079 17076->17084 17077 7ff75c2cb190 _wfindfirst32i64 8 API calls 17078 7ff75c2d3e9e 17077->17078 17078->17012 17079->17081 17080 7ff75c2d4870 45 API calls 17083 7ff75c2d3d90 17080->17083 17081->17080 17081->17083 17081->17084 17082 7ff75c2df288 46 API calls 17082->17083 17083->17082 17083->17084 17084->17077 17163 7ff75c2d0608 17085->17163 17089 7ff75c2d4232 17088->17089 17090 7ff75c2d01c0 12 API calls 17089->17090 17091 7ff75c2d4282 17090->17091 17092 7ff75c2dedf0 46 API calls 17091->17092 17093 7ff75c2d4355 17092->17093 17094 7ff75c2d4870 45 API calls 17093->17094 17096 7ff75c2d4377 17093->17096 17094->17096 17096->17096 17099 7ff75c2d457d 17098->17099 17100 7ff75c2d45c2 17099->17100 17101 7ff75c2d459b 17099->17101 17102 7ff75c2d4870 45 API calls 17099->17102 17100->17044 17103 7ff75c2df288 46 API calls 17101->17103 17102->17101 17103->17100 17106 7ff75c2d13c7 17104->17106 17105 7ff75c2d13f6 17110 7ff75c2d1433 17105->17110 17141 7ff75c2d0268 17105->17141 17106->17105 17108 7ff75c2d14b3 17106->17108 17109 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17108->17109 17109->17110 17110->17044 17112 7ff75c2d0fb7 17111->17112 17113 7ff75c2d0fe6 17112->17113 17115 7ff75c2d10a3 17112->17115 17114 7ff75c2d0268 12 API calls 17113->17114 17117 7ff75c2d1023 17113->17117 17114->17117 17116 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17115->17116 17116->17117 17117->17044 17119 7ff75c2d47a3 17118->17119 17121 7ff75c2d47a7 __crtLCMapStringW 17119->17121 17149 7ff75c2d47fc 17119->17149 17121->17044 17123 7ff75c2d17d7 17122->17123 17124 7ff75c2d1806 17123->17124 17126 7ff75c2d18c3 17123->17126 17125 7ff75c2d0268 12 API calls 17124->17125 17128 7ff75c2d1843 17124->17128 17125->17128 17127 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17126->17127 17127->17128 17128->17044 17130 7ff75c2df2b9 17129->17130 17139 7ff75c2df2c7 17129->17139 17131 7ff75c2df2e7 17130->17131 17132 7ff75c2d4870 45 API calls 17130->17132 17130->17139 17133 7ff75c2df31f 17131->17133 17134 7ff75c2df2f8 17131->17134 17132->17131 17136 7ff75c2df3aa 17133->17136 17137 7ff75c2df349 17133->17137 17133->17139 17153 7ff75c2e0c70 17134->17153 17137->17139 17139->17047 17142 7ff75c2d029f 17141->17142 17148 7ff75c2d028e 17141->17148 17143 7ff75c2dde7c _fread_nolock 12 API calls 17142->17143 17142->17148 17144 7ff75c2d02d0 17143->17144 17145 7ff75c2d02e4 17144->17145 17146 7ff75c2db1cc __free_lconv_num 11 API calls 17144->17146 17147 7ff75c2db1cc __free_lconv_num 11 API calls 17145->17147 17146->17145 17147->17148 17148->17110 17150 7ff75c2d481a 17149->17150 17152 7ff75c2d4822 17149->17152 17151 7ff75c2d4870 45 API calls 17150->17151 17151->17152 17152->17121 17159 7ff75c2e78d0 17153->17159 17164 7ff75c2d064f 17163->17164 17165 7ff75c2d063d 17163->17165 17168 7ff75c2d065d 17164->17168 17171 7ff75c2d0699 17164->17171 17166 7ff75c2d7c48 _findclose 11 API calls 17165->17166 17167 7ff75c2d0642 17166->17167 17169 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 17167->17169 17170 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 17168->17170 17177 7ff75c2d064d 17169->17177 17170->17177 17172 7ff75c2d0a15 17171->17172 17173 7ff75c2d7c48 _findclose 11 API calls 17171->17173 17174 7ff75c2d7c48 _findclose 11 API calls 17172->17174 17172->17177 17176 7ff75c2d0a0a 17173->17176 17175 7ff75c2d0ca9 17174->17175 17178 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 17175->17178 17179 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 17176->17179 17177->17012 17178->17177 17179->17172 17221 7ff75c2e1db8 17180->17221 17280 7ff75c2e1b30 17221->17280 17301 7ff75c2e0ea8 EnterCriticalSection 17280->17301 17312 7ff75c2c78d5 17311->17312 17313 7ff75c2d4f14 48 API calls 17312->17313 17314 7ff75c2c78f8 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 17313->17314 17314->16948 17314->16949 17316 7ff75c2d7cb9 17315->17316 17317 7ff75c2d7c86 17315->17317 17316->16970 17317->17316 17318 7ff75c2e1044 _wfindfirst32i64 37 API calls 17317->17318 17319 7ff75c2d7cb5 17318->17319 17319->17316 17320 7ff75c2db184 _wfindfirst32i64 17 API calls 17319->17320 17321 7ff75c2d7ce9 17320->17321 17323 7ff75c2d6594 17322->17323 17324 7ff75c2d6602 17322->17324 17323->17324 17326 7ff75c2d6599 17323->17326 17359 7ff75c2e0690 17324->17359 17327 7ff75c2d65b1 17326->17327 17328 7ff75c2d65ce 17326->17328 17334 7ff75c2d6348 GetFullPathNameW 17327->17334 17342 7ff75c2d63bc GetFullPathNameW 17328->17342 17333 7ff75c2d65c6 __vcrt_freefls 17333->16970 17335 7ff75c2d6384 17334->17335 17336 7ff75c2d636e GetLastError 17334->17336 17338 7ff75c2d6380 17335->17338 17341 7ff75c2d7c48 _findclose 11 API calls 17335->17341 17337 7ff75c2d7bbc _fread_nolock 11 API calls 17336->17337 17339 7ff75c2d637b 17337->17339 17338->17333 17340 7ff75c2d7c48 _findclose 11 API calls 17339->17340 17340->17338 17341->17338 17343 7ff75c2d6405 __vcrt_freefls 17342->17343 17344 7ff75c2d63ef GetLastError 17342->17344 17348 7ff75c2d645f GetFullPathNameW 17343->17348 17349 7ff75c2d6401 17343->17349 17345 7ff75c2d7bbc _fread_nolock 11 API calls 17344->17345 17346 7ff75c2d63fc 17345->17346 17347 7ff75c2d7c48 _findclose 11 API calls 17346->17347 17347->17349 17348->17344 17348->17349 17350 7ff75c2d6494 17349->17350 17354 7ff75c2d6508 memcpy_s 17350->17354 17355 7ff75c2d64bd memcpy_s 17350->17355 17351 7ff75c2d64f1 17354->17333 17355->17351 17355->17354 17356 7ff75c2d652a 17355->17356 17356->17354 17362 7ff75c2e04a0 17359->17362 17363 7ff75c2e04e2 17362->17363 17364 7ff75c2e04cb 17362->17364 17366 7ff75c2e04e6 17363->17366 17367 7ff75c2e0507 17363->17367 17365 7ff75c2d7c48 _findclose 11 API calls 17364->17365 17369 7ff75c2e04d0 17365->17369 17388 7ff75c2e060c 17366->17388 17400 7ff75c2dfb08 17367->17400 17373 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 17369->17373 17384 7ff75c2e04db __vcrt_freefls 17373->17384 17378 7ff75c2cb190 _wfindfirst32i64 8 API calls 17384->17378 17389 7ff75c2e0656 17388->17389 17390 7ff75c2e0626 17388->17390 17392 7ff75c2e0661 GetDriveTypeW 17389->17392 17393 7ff75c2e0641 17389->17393 17391 7ff75c2d7c28 _fread_nolock 11 API calls 17390->17391 17394 7ff75c2e062b 17391->17394 17392->17393 17396 7ff75c2cb190 _wfindfirst32i64 8 API calls 17393->17396 17414 7ff75c2cc8b0 17400->17414 17403 7ff75c2dfb55 17404 7ff75c2dfb7c 17415 7ff75c2cc890 GetCurrentDirectoryW 17414->17415 17415->17403 17415->17404 17423 7ff75c2e0ea8 EnterCriticalSection 17416->17423 17425 7ff75c2c1726 17424->17425 17426 7ff75c2c173e 17424->17426 17427 7ff75c2c2010 86 API calls 17425->17427 17428 7ff75c2c1744 17426->17428 17429 7ff75c2c1768 17426->17429 17430 7ff75c2c1732 17427->17430 17556 7ff75c2c12b0 17428->17556 17517 7ff75c2c6e10 17429->17517 17430->16265 17435 7ff75c2c17b9 17439 7ff75c2c31a0 120 API calls 17435->17439 17436 7ff75c2c178d 17438 7ff75c2c1fd0 86 API calls 17436->17438 17437 7ff75c2c175f 17437->16265 17441 7ff75c2c17a3 17438->17441 17442 7ff75c2c17ce 17439->17442 17440 7ff75c2c2010 86 API calls 17440->17437 17441->16265 17443 7ff75c2c17d6 17442->17443 17444 7ff75c2c17ee 17442->17444 17445 7ff75c2c2010 86 API calls 17443->17445 17446 7ff75c2cfcd4 73 API calls 17444->17446 17447 7ff75c2c17e5 17445->17447 17448 7ff75c2c17ff 17446->17448 17467 7ff75c2c21a6 17466->17467 17468 7ff75c2c1ef0 49 API calls 17467->17468 17469 7ff75c2c21d9 17468->17469 17470 7ff75c2c3010 49 API calls 17469->17470 17495 7ff75c2c250a 17469->17495 17471 7ff75c2c2247 17470->17471 17472 7ff75c2c3010 49 API calls 17471->17472 17473 7ff75c2c2258 17472->17473 17474 7ff75c2c22b5 17473->17474 17475 7ff75c2c2279 17473->17475 17477 7ff75c2c25d0 75 API calls 17474->17477 17682 7ff75c2c25d0 17475->17682 17478 7ff75c2c22b3 17477->17478 17479 7ff75c2c2336 17478->17479 17480 7ff75c2c22f4 17478->17480 17481 7ff75c2c25d0 75 API calls 17479->17481 17690 7ff75c2c67a0 17480->17690 17483 7ff75c2c2360 17481->17483 17488 7ff75c2c25d0 75 API calls 17483->17488 17492 7ff75c2c23fc 17483->17492 17490 7ff75c2c2392 17488->17490 17490->17492 17491 7ff75c2c1eb0 86 API calls 17492->17491 17509 7ff75c2c250f 17492->17509 17518 7ff75c2c6e20 17517->17518 17519 7ff75c2c1ef0 49 API calls 17518->17519 17520 7ff75c2c6e61 17519->17520 17535 7ff75c2c6ee1 17520->17535 17599 7ff75c2c3130 17520->17599 17522 7ff75c2cb190 _wfindfirst32i64 8 API calls 17523 7ff75c2c1785 17522->17523 17523->17435 17523->17436 17524 7ff75c2c6f1b 17605 7ff75c2c69c0 17524->17605 17527 7ff75c2c6d60 92 API calls 17532 7ff75c2c6e92 __vcrt_freefls 17527->17532 17529 7ff75c2c6ed0 17533 7ff75c2c2010 86 API calls 17529->17533 17530 7ff75c2c6f04 17531 7ff75c2c2010 86 API calls 17530->17531 17531->17524 17532->17529 17532->17530 17533->17535 17535->17522 17557 7ff75c2c12c2 17556->17557 17558 7ff75c2c31a0 120 API calls 17557->17558 17559 7ff75c2c12f2 17558->17559 17560 7ff75c2c1311 17559->17560 17561 7ff75c2c12fa 17559->17561 17563 7ff75c2cfcd4 73 API calls 17560->17563 17562 7ff75c2c2010 86 API calls 17561->17562 17592 7ff75c2c130a __vcrt_freefls 17562->17592 17564 7ff75c2c1323 17563->17564 17565 7ff75c2c1327 17564->17565 17566 7ff75c2c134d 17564->17566 17567 7ff75c2c1fd0 86 API calls 17565->17567 17569 7ff75c2c1390 17566->17569 17570 7ff75c2c1368 17566->17570 17568 7ff75c2c133e 17567->17568 17572 7ff75c2cf64c 74 API calls 17568->17572 17574 7ff75c2c13aa 17569->17574 17586 7ff75c2c1463 17569->17586 17573 7ff75c2c1fd0 86 API calls 17570->17573 17571 7ff75c2cb190 _wfindfirst32i64 8 API calls 17575 7ff75c2c1454 17571->17575 17572->17592 17577 7ff75c2c1383 17573->17577 17578 7ff75c2c1050 94 API calls 17574->17578 17575->17437 17575->17440 17576 7ff75c2c13c3 17581 7ff75c2cf64c 74 API calls 17576->17581 17579 7ff75c2cf64c 74 API calls 17577->17579 17580 7ff75c2c13bb 17578->17580 17579->17592 17580->17576 17583 7ff75c2c14d2 __vcrt_freefls 17580->17583 17584 7ff75c2c13cf 17581->17584 17582 7ff75c2cf99c _fread_nolock 53 API calls 17582->17586 17586->17576 17586->17582 17588 7ff75c2c14bb 17586->17588 17589 7ff75c2c1fd0 86 API calls 17588->17589 17589->17583 17592->17571 17600 7ff75c2c313a 17599->17600 17601 7ff75c2c7fb0 88 API calls 17600->17601 17602 7ff75c2c3162 17601->17602 17603 7ff75c2cb190 _wfindfirst32i64 8 API calls 17602->17603 17604 7ff75c2c318a 17603->17604 17604->17524 17604->17527 17604->17532 17606 7ff75c2c69d0 17605->17606 17683 7ff75c2c2604 17682->17683 17684 7ff75c2d4cc0 49 API calls 17683->17684 17685 7ff75c2c262a 17684->17685 17686 7ff75c2c263b 17685->17686 17742 7ff75c2d5fb4 17685->17742 17688 7ff75c2cb190 _wfindfirst32i64 8 API calls 17686->17688 17689 7ff75c2c2659 17688->17689 17689->17478 17691 7ff75c2c67ae 17690->17691 17692 7ff75c2c31a0 120 API calls 17691->17692 17693 7ff75c2c67dd 17692->17693 17743 7ff75c2d5fd1 17742->17743 17744 7ff75c2d5fdd 17742->17744 17759 7ff75c2d58c8 17743->17759 17784 7ff75c2d5194 17744->17784 18006 7ff75c2d662c 18005->18006 18007 7ff75c2d6652 18006->18007 18009 7ff75c2d6685 18006->18009 18008 7ff75c2d7c48 _findclose 11 API calls 18007->18008 18010 7ff75c2d6657 18008->18010 18012 7ff75c2d668b 18009->18012 18013 7ff75c2d6698 18009->18013 18011 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 18010->18011 18016 7ff75c2c31f9 18011->18016 18014 7ff75c2d7c48 _findclose 11 API calls 18012->18014 18024 7ff75c2db4ac 18013->18024 18014->18016 18016->16332 18037 7ff75c2e0ea8 EnterCriticalSection 18024->18037 18385 7ff75c2d9364 18384->18385 18388 7ff75c2d8e40 18385->18388 18389 7ff75c2d8e5b 18388->18389 18390 7ff75c2d8e8a 18388->18390 18391 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 18389->18391 18398 7ff75c2d556c EnterCriticalSection 18390->18398 18393 7ff75c2d8e7b 18391->18393 18400 7ff75c2cf443 18399->18400 18401 7ff75c2cf471 18399->18401 18403 7ff75c2db098 _invalid_parameter_noinfo 37 API calls 18400->18403 18402 7ff75c2cf463 18401->18402 18409 7ff75c2d556c EnterCriticalSection 18401->18409 18403->18402 18411 7ff75c2c31a0 120 API calls 18410->18411 18412 7ff75c2c15c7 18411->18412 18413 7ff75c2c15f0 18412->18413 18414 7ff75c2c15cf 18412->18414 18415 7ff75c2cfcd4 73 API calls 18413->18415 18416 7ff75c2c2010 86 API calls 18414->18416 18417 7ff75c2c1601 18415->18417 18418 7ff75c2c15df 18416->18418 18419 7ff75c2c1621 18417->18419 18420 7ff75c2c1605 18417->18420 18418->16361 18422 7ff75c2c1651 18419->18422 18423 7ff75c2c1631 18419->18423 18421 7ff75c2c1fd0 86 API calls 18420->18421 18432 7ff75c2c161c __vcrt_freefls 18421->18432 18425 7ff75c2c1666 18422->18425 18430 7ff75c2c167d 18422->18430 18424 7ff75c2c1fd0 86 API calls 18423->18424 18424->18432 18428 7ff75c2c1050 94 API calls 18425->18428 18426 7ff75c2cf64c 74 API calls 18427 7ff75c2c16f7 18426->18427 18427->16361 18428->18432 18429 7ff75c2cf99c _fread_nolock 53 API calls 18429->18430 18430->18429 18431 7ff75c2c16be 18430->18431 18430->18432 18433 7ff75c2c1fd0 86 API calls 18431->18433 18432->18426 18433->18432 18435 7ff75c2c196f 18434->18435 18437 7ff75c2c19d3 18434->18437 18436 7ff75c2d526c 45 API calls 18435->18436 18435->18437 18436->18435 18437->16376 18439 7ff75c2c7fb0 88 API calls 18438->18439 18440 7ff75c2c7477 LoadLibraryExW 18439->18440 18441 7ff75c2c7494 __vcrt_freefls 18440->18441 18441->16388 18502 7ff75c2c4dd0 18501->18502 18503 7ff75c2c1ef0 49 API calls 18502->18503 18504 7ff75c2c4e02 18503->18504 18505 7ff75c2c4e2b 18504->18505 18506 7ff75c2c4e0b 18504->18506 18508 7ff75c2c4e82 18505->18508 18510 7ff75c2c3220 49 API calls 18505->18510 18507 7ff75c2c2010 86 API calls 18506->18507 18528 7ff75c2c4e21 18507->18528 18509 7ff75c2c3220 49 API calls 18508->18509 18512 7ff75c2c4e9b 18509->18512 18511 7ff75c2c4e4c 18510->18511 18514 7ff75c2c4e6a 18511->18514 18518 7ff75c2c2010 86 API calls 18511->18518 18513 7ff75c2c4eb9 18512->18513 18516 7ff75c2c2010 86 API calls 18512->18516 18517 7ff75c2c7460 89 API calls 18513->18517 18519 7ff75c2c3130 88 API calls 18514->18519 18515 7ff75c2cb190 _wfindfirst32i64 8 API calls 18520 7ff75c2c267e 18515->18520 18516->18513 18521 7ff75c2c4ec6 18517->18521 18518->18514 18522 7ff75c2c4e74 18519->18522 18520->16409 18529 7ff75c2c4f20 18520->18529 18523 7ff75c2c4eed 18521->18523 18524 7ff75c2c4ecb 18521->18524 18522->18508 18527 7ff75c2c7460 89 API calls 18522->18527 18585 7ff75c2c43b0 GetProcAddress 18523->18585 18525 7ff75c2c2070 86 API calls 18524->18525 18525->18528 18527->18508 18528->18515 18669 7ff75c2c3fb0 18529->18669 18531 7ff75c2c4f44 18532 7ff75c2c4f5d 18531->18532 18533 7ff75c2c4f4c 18531->18533 18586 7ff75c2c43d2 18585->18586 18587 7ff75c2c43f0 GetProcAddress 18585->18587 18589 7ff75c2c2070 86 API calls 18586->18589 18587->18586 18588 7ff75c2c4415 GetProcAddress 18587->18588 18588->18586 18671 7ff75c2c3fd5 18669->18671 18670 7ff75c2c3fdd 18670->18531 18671->18670 18674 7ff75c2c416f 18671->18674 18711 7ff75c2d7208 18671->18711 18672 7ff75c2c431a __vcrt_freefls 18672->18531 18673 7ff75c2c3420 47 API calls 18673->18674 18674->18672 18674->18673 18712 7ff75c2d7238 18711->18712 18715 7ff75c2d6704 18712->18715 19783 7ff75c2e1cc0 19801 7ff75c2e0ea8 EnterCriticalSection 19783->19801 15782 7ff75c2da1b1 15794 7ff75c2dac28 15782->15794 15799 7ff75c2db9d0 GetLastError 15794->15799 15800 7ff75c2db9f4 FlsGetValue 15799->15800 15801 7ff75c2dba11 FlsSetValue 15799->15801 15803 7ff75c2dba01 15800->15803 15804 7ff75c2dba0b 15800->15804 15802 7ff75c2dba23 15801->15802 15801->15803 15806 7ff75c2df430 _findclose 11 API calls 15802->15806 15805 7ff75c2dba7d SetLastError 15803->15805 15804->15801 15807 7ff75c2dba9d 15805->15807 15808 7ff75c2dac31 15805->15808 15809 7ff75c2dba32 15806->15809 15810 7ff75c2dad5c __CxxCallCatchBlock 38 API calls 15807->15810 15821 7ff75c2dad5c 15808->15821 15811 7ff75c2dba50 FlsSetValue 15809->15811 15812 7ff75c2dba40 FlsSetValue 15809->15812 15813 7ff75c2dbaa2 15810->15813 15815 7ff75c2dba5c FlsSetValue 15811->15815 15816 7ff75c2dba6e 15811->15816 15814 7ff75c2dba49 15812->15814 15817 7ff75c2db1cc __free_lconv_num 11 API calls 15814->15817 15815->15814 15818 7ff75c2db778 _findclose 11 API calls 15816->15818 15817->15803 15819 7ff75c2dba76 15818->15819 15820 7ff75c2db1cc __free_lconv_num 11 API calls 15819->15820 15820->15805 15830 7ff75c2e3eb0 15821->15830 15856 7ff75c2e3e68 15830->15856 15861 7ff75c2e0ea8 EnterCriticalSection 15856->15861 18969 7ff75c2e1128 18970 7ff75c2e114c 18969->18970 18972 7ff75c2e115c 18969->18972 18971 7ff75c2d7c48 _findclose 11 API calls 18970->18971 18994 7ff75c2e1151 18971->18994 18973 7ff75c2e143c 18972->18973 18974 7ff75c2e117e 18972->18974 18975 7ff75c2d7c48 _findclose 11 API calls 18973->18975 18976 7ff75c2e119f 18974->18976 19100 7ff75c2e17e4 18974->19100 18977 7ff75c2e1441 18975->18977 18980 7ff75c2e1211 18976->18980 18981 7ff75c2e11c5 18976->18981 18986 7ff75c2e1205 18976->18986 18979 7ff75c2db1cc __free_lconv_num 11 API calls 18977->18979 18979->18994 18983 7ff75c2df430 _findclose 11 API calls 18980->18983 18998 7ff75c2e11d4 18980->18998 19115 7ff75c2d9f14 18981->19115 18982 7ff75c2e12be 18993 7ff75c2e12db 18982->18993 18999 7ff75c2e132d 18982->18999 18987 7ff75c2e1227 18983->18987 18986->18982 18986->18998 19121 7ff75c2e7bec 18986->19121 18990 7ff75c2db1cc __free_lconv_num 11 API calls 18987->18990 18989 7ff75c2db1cc __free_lconv_num 11 API calls 18989->18994 18995 7ff75c2e1235 18990->18995 18991 7ff75c2e11cf 18996 7ff75c2d7c48 _findclose 11 API calls 18991->18996 18992 7ff75c2e11ed 18992->18986 19001 7ff75c2e17e4 45 API calls 18992->19001 18997 7ff75c2db1cc __free_lconv_num 11 API calls 18993->18997 18995->18986 18995->18998 19003 7ff75c2df430 _findclose 11 API calls 18995->19003 18996->18998 19000 7ff75c2e12e4 18997->19000 18998->18989 18999->18998 19002 7ff75c2e3c3c 40 API calls 18999->19002 19009 7ff75c2e12e9 19000->19009 19157 7ff75c2e3c3c 19000->19157 19001->18986 19004 7ff75c2e136a 19002->19004 19005 7ff75c2e1257 19003->19005 19006 7ff75c2db1cc __free_lconv_num 11 API calls 19004->19006 19011 7ff75c2db1cc __free_lconv_num 11 API calls 19005->19011 19012 7ff75c2e1374 19006->19012 19008 7ff75c2e1430 19014 7ff75c2db1cc __free_lconv_num 11 API calls 19008->19014 19009->19008 19015 7ff75c2df430 _findclose 11 API calls 19009->19015 19010 7ff75c2e1315 19013 7ff75c2db1cc __free_lconv_num 11 API calls 19010->19013 19011->18986 19012->18998 19012->19009 19013->19009 19014->18994 19016 7ff75c2e13b8 19015->19016 19017 7ff75c2e13c0 19016->19017 19018 7ff75c2e13c9 19016->19018 19019 7ff75c2db1cc __free_lconv_num 11 API calls 19017->19019 19020 7ff75c2dacfc __std_exception_copy 37 API calls 19018->19020 19021 7ff75c2e13c7 19019->19021 19022 7ff75c2e13d8 19020->19022 19026 7ff75c2db1cc __free_lconv_num 11 API calls 19021->19026 19023 7ff75c2e13e0 19022->19023 19024 7ff75c2e146b 19022->19024 19166 7ff75c2e7d04 19023->19166 19025 7ff75c2db184 _wfindfirst32i64 17 API calls 19024->19025 19028 7ff75c2e147f 19025->19028 19026->18994 19030 7ff75c2e14a8 19028->19030 19039 7ff75c2e14b8 19028->19039 19033 7ff75c2d7c48 _findclose 11 API calls 19030->19033 19031 7ff75c2e1428 19034 7ff75c2db1cc __free_lconv_num 11 API calls 19031->19034 19032 7ff75c2e1407 19035 7ff75c2d7c48 _findclose 11 API calls 19032->19035 19037 7ff75c2e14ad 19033->19037 19034->19008 19036 7ff75c2e140c 19035->19036 19038 7ff75c2db1cc __free_lconv_num 11 API calls 19036->19038 19038->19021 19040 7ff75c2e179b 19039->19040 19041 7ff75c2e14da 19039->19041 19042 7ff75c2d7c48 _findclose 11 API calls 19040->19042 19043 7ff75c2e14f7 19041->19043 19185 7ff75c2e18cc 19041->19185 19044 7ff75c2e17a0 19042->19044 19047 7ff75c2e156b 19043->19047 19049 7ff75c2e151f 19043->19049 19057 7ff75c2e155f 19043->19057 19046 7ff75c2db1cc __free_lconv_num 11 API calls 19044->19046 19046->19037 19051 7ff75c2e1593 19047->19051 19053 7ff75c2df430 _findclose 11 API calls 19047->19053 19067 7ff75c2e152e 19047->19067 19048 7ff75c2e161e 19062 7ff75c2e163b 19048->19062 19068 7ff75c2e168e 19048->19068 19200 7ff75c2d9f50 19049->19200 19055 7ff75c2df430 _findclose 11 API calls 19051->19055 19051->19057 19051->19067 19058 7ff75c2e1585 19053->19058 19061 7ff75c2e15b5 19055->19061 19056 7ff75c2db1cc __free_lconv_num 11 API calls 19056->19037 19057->19048 19057->19067 19206 7ff75c2e7aac 19057->19206 19063 7ff75c2db1cc __free_lconv_num 11 API calls 19058->19063 19059 7ff75c2e1547 19059->19057 19069 7ff75c2e18cc 45 API calls 19059->19069 19060 7ff75c2e1529 19064 7ff75c2d7c48 _findclose 11 API calls 19060->19064 19065 7ff75c2db1cc __free_lconv_num 11 API calls 19061->19065 19066 7ff75c2db1cc __free_lconv_num 11 API calls 19062->19066 19063->19051 19064->19067 19065->19057 19071 7ff75c2e1644 19066->19071 19067->19056 19068->19067 19070 7ff75c2e3c3c 40 API calls 19068->19070 19069->19057 19072 7ff75c2e16cc 19070->19072 19073 7ff75c2e3c3c 40 API calls 19071->19073 19077 7ff75c2e164a 19071->19077 19074 7ff75c2db1cc __free_lconv_num 11 API calls 19072->19074 19075 7ff75c2e1676 19073->19075 19078 7ff75c2e16d6 19074->19078 19079 7ff75c2db1cc __free_lconv_num 11 API calls 19075->19079 19076 7ff75c2e178f 19080 7ff75c2db1cc __free_lconv_num 11 API calls 19076->19080 19077->19076 19081 7ff75c2df430 _findclose 11 API calls 19077->19081 19078->19067 19078->19077 19079->19077 19080->19037 19082 7ff75c2e171b 19081->19082 19083 7ff75c2e1723 19082->19083 19084 7ff75c2e172c 19082->19084 19085 7ff75c2db1cc __free_lconv_num 11 API calls 19083->19085 19086 7ff75c2e1044 _wfindfirst32i64 37 API calls 19084->19086 19087 7ff75c2e172a 19085->19087 19088 7ff75c2e173a 19086->19088 19092 7ff75c2db1cc __free_lconv_num 11 API calls 19087->19092 19089 7ff75c2e17cf 19088->19089 19090 7ff75c2e1742 SetEnvironmentVariableW 19088->19090 19091 7ff75c2db184 _wfindfirst32i64 17 API calls 19089->19091 19093 7ff75c2e1766 19090->19093 19094 7ff75c2e1787 19090->19094 19095 7ff75c2e17e3 19091->19095 19092->19037 19097 7ff75c2d7c48 _findclose 11 API calls 19093->19097 19096 7ff75c2db1cc __free_lconv_num 11 API calls 19094->19096 19096->19076 19098 7ff75c2e176b 19097->19098 19099 7ff75c2db1cc __free_lconv_num 11 API calls 19098->19099 19099->19087 19101 7ff75c2e1801 19100->19101 19102 7ff75c2e1819 19100->19102 19101->18976 19103 7ff75c2df430 _findclose 11 API calls 19102->19103 19109 7ff75c2e183d 19103->19109 19104 7ff75c2e189e 19106 7ff75c2db1cc __free_lconv_num 11 API calls 19104->19106 19105 7ff75c2dad5c __CxxCallCatchBlock 45 API calls 19107 7ff75c2e18c8 19105->19107 19106->19101 19108 7ff75c2df430 _findclose 11 API calls 19108->19109 19109->19104 19109->19108 19110 7ff75c2db1cc __free_lconv_num 11 API calls 19109->19110 19111 7ff75c2dacfc __std_exception_copy 37 API calls 19109->19111 19112 7ff75c2e18ad 19109->19112 19114 7ff75c2e18c2 19109->19114 19110->19109 19111->19109 19113 7ff75c2db184 _wfindfirst32i64 17 API calls 19112->19113 19113->19114 19114->19105 19116 7ff75c2d9f24 19115->19116 19117 7ff75c2d9f2d 19115->19117 19116->19117 19230 7ff75c2d99ec 19116->19230 19117->18991 19117->18992 19122 7ff75c2e6d9c 19121->19122 19123 7ff75c2e7bf9 19121->19123 19124 7ff75c2e6da9 19122->19124 19132 7ff75c2e6ddf 19122->19132 19125 7ff75c2d5194 45 API calls 19123->19125 19128 7ff75c2d7c48 _findclose 11 API calls 19124->19128 19142 7ff75c2e6d50 19124->19142 19126 7ff75c2e7c2d 19125->19126 19129 7ff75c2e7c32 19126->19129 19133 7ff75c2e7c43 19126->19133 19137 7ff75c2e7c5a 19126->19137 19127 7ff75c2e6e09 19130 7ff75c2d7c48 _findclose 11 API calls 19127->19130 19131 7ff75c2e6db3 19128->19131 19129->18986 19134 7ff75c2e6e0e 19130->19134 19135 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19131->19135 19132->19127 19136 7ff75c2e6e2e 19132->19136 19138 7ff75c2d7c48 _findclose 11 API calls 19133->19138 19139 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19134->19139 19140 7ff75c2e6dbe 19135->19140 19141 7ff75c2d5194 45 API calls 19136->19141 19147 7ff75c2e6e19 19136->19147 19144 7ff75c2e7c64 19137->19144 19145 7ff75c2e7c76 19137->19145 19143 7ff75c2e7c48 19138->19143 19139->19147 19140->18986 19141->19147 19142->18986 19150 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19143->19150 19146 7ff75c2d7c48 _findclose 11 API calls 19144->19146 19148 7ff75c2e7c9e 19145->19148 19149 7ff75c2e7c87 19145->19149 19151 7ff75c2e7c69 19146->19151 19147->18986 19456 7ff75c2e9a14 19148->19456 19447 7ff75c2e6dec 19149->19447 19150->19129 19154 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19151->19154 19154->19129 19156 7ff75c2d7c48 _findclose 11 API calls 19156->19129 19158 7ff75c2e3c7b 19157->19158 19159 7ff75c2e3c5e 19157->19159 19160 7ff75c2e3c85 19158->19160 19496 7ff75c2e86f8 19158->19496 19159->19158 19161 7ff75c2e3c6c 19159->19161 19503 7ff75c2e10ac 19160->19503 19163 7ff75c2d7c48 _findclose 11 API calls 19161->19163 19165 7ff75c2e3c71 memcpy_s 19163->19165 19165->19010 19167 7ff75c2d5194 45 API calls 19166->19167 19168 7ff75c2e7d6a 19167->19168 19169 7ff75c2e7d78 19168->19169 19170 7ff75c2df6bc 5 API calls 19168->19170 19171 7ff75c2d574c 14 API calls 19169->19171 19170->19169 19172 7ff75c2e7dd4 19171->19172 19173 7ff75c2e7e64 19172->19173 19174 7ff75c2d5194 45 API calls 19172->19174 19176 7ff75c2e7e75 19173->19176 19177 7ff75c2db1cc __free_lconv_num 11 API calls 19173->19177 19175 7ff75c2e7de7 19174->19175 19179 7ff75c2df6bc 5 API calls 19175->19179 19181 7ff75c2e7df0 19175->19181 19178 7ff75c2e1403 19176->19178 19180 7ff75c2db1cc __free_lconv_num 11 API calls 19176->19180 19177->19176 19178->19031 19178->19032 19179->19181 19180->19178 19182 7ff75c2d574c 14 API calls 19181->19182 19183 7ff75c2e7e4b 19182->19183 19183->19173 19184 7ff75c2e7e53 SetEnvironmentVariableW 19183->19184 19184->19173 19186 7ff75c2e18ef 19185->19186 19187 7ff75c2e190c 19185->19187 19186->19043 19188 7ff75c2df430 _findclose 11 API calls 19187->19188 19195 7ff75c2e1930 19188->19195 19189 7ff75c2e19b4 19191 7ff75c2dad5c __CxxCallCatchBlock 45 API calls 19189->19191 19190 7ff75c2e1991 19193 7ff75c2db1cc __free_lconv_num 11 API calls 19190->19193 19192 7ff75c2e19ba 19191->19192 19193->19186 19194 7ff75c2df430 _findclose 11 API calls 19194->19195 19195->19189 19195->19190 19195->19194 19196 7ff75c2db1cc __free_lconv_num 11 API calls 19195->19196 19197 7ff75c2e1044 _wfindfirst32i64 37 API calls 19195->19197 19198 7ff75c2e19a0 19195->19198 19196->19195 19197->19195 19199 7ff75c2db184 _wfindfirst32i64 17 API calls 19198->19199 19199->19189 19201 7ff75c2d9f60 19200->19201 19205 7ff75c2d9f69 19200->19205 19202 7ff75c2d9a60 40 API calls 19201->19202 19201->19205 19203 7ff75c2d9f72 19202->19203 19204 7ff75c2d9e20 12 API calls 19203->19204 19203->19205 19204->19205 19205->19059 19205->19060 19207 7ff75c2e7ab9 19206->19207 19210 7ff75c2e7ae6 19206->19210 19208 7ff75c2e7abe 19207->19208 19207->19210 19209 7ff75c2d7c48 _findclose 11 API calls 19208->19209 19212 7ff75c2e7ac3 19209->19212 19211 7ff75c2e7b2a 19210->19211 19214 7ff75c2e7b49 19210->19214 19227 7ff75c2e7b1e __crtLCMapStringW 19210->19227 19213 7ff75c2d7c48 _findclose 11 API calls 19211->19213 19215 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19212->19215 19216 7ff75c2e7b2f 19213->19216 19217 7ff75c2e7b53 19214->19217 19218 7ff75c2e7b65 19214->19218 19219 7ff75c2e7ace 19215->19219 19220 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19216->19220 19221 7ff75c2d7c48 _findclose 11 API calls 19217->19221 19222 7ff75c2d5194 45 API calls 19218->19222 19219->19057 19220->19227 19223 7ff75c2e7b58 19221->19223 19224 7ff75c2e7b72 19222->19224 19225 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19223->19225 19224->19227 19515 7ff75c2e95d0 19224->19515 19225->19227 19227->19057 19229 7ff75c2d7c48 _findclose 11 API calls 19229->19227 19231 7ff75c2d9a05 19230->19231 19240 7ff75c2d9a01 19230->19240 19253 7ff75c2e2e50 19231->19253 19236 7ff75c2d9a23 19279 7ff75c2d9ad0 19236->19279 19237 7ff75c2d9a17 19238 7ff75c2db1cc __free_lconv_num 11 API calls 19237->19238 19238->19240 19240->19117 19245 7ff75c2d9d40 19240->19245 19242 7ff75c2db1cc __free_lconv_num 11 API calls 19243 7ff75c2d9a4a 19242->19243 19244 7ff75c2db1cc __free_lconv_num 11 API calls 19243->19244 19244->19240 19246 7ff75c2d9d69 19245->19246 19251 7ff75c2d9d82 19245->19251 19246->19117 19247 7ff75c2e06b8 WideCharToMultiByte 19247->19251 19248 7ff75c2df430 _findclose 11 API calls 19248->19251 19249 7ff75c2d9e12 19250 7ff75c2db1cc __free_lconv_num 11 API calls 19249->19250 19250->19246 19251->19246 19251->19247 19251->19248 19251->19249 19252 7ff75c2db1cc __free_lconv_num 11 API calls 19251->19252 19252->19251 19254 7ff75c2e2e5d 19253->19254 19255 7ff75c2d9a0a 19253->19255 19298 7ff75c2dbaa4 19254->19298 19259 7ff75c2e318c GetEnvironmentStringsW 19255->19259 19260 7ff75c2d9a0f 19259->19260 19261 7ff75c2e31bc 19259->19261 19260->19236 19260->19237 19262 7ff75c2e06b8 WideCharToMultiByte 19261->19262 19263 7ff75c2e320d 19262->19263 19264 7ff75c2e3214 FreeEnvironmentStringsW 19263->19264 19265 7ff75c2dde7c _fread_nolock 12 API calls 19263->19265 19264->19260 19266 7ff75c2e3227 19265->19266 19267 7ff75c2e322f 19266->19267 19268 7ff75c2e3238 19266->19268 19270 7ff75c2db1cc __free_lconv_num 11 API calls 19267->19270 19269 7ff75c2e06b8 WideCharToMultiByte 19268->19269 19272 7ff75c2e325b 19269->19272 19271 7ff75c2e3236 19270->19271 19271->19264 19273 7ff75c2e325f 19272->19273 19274 7ff75c2e3269 19272->19274 19275 7ff75c2db1cc __free_lconv_num 11 API calls 19273->19275 19276 7ff75c2db1cc __free_lconv_num 11 API calls 19274->19276 19277 7ff75c2e3267 FreeEnvironmentStringsW 19275->19277 19276->19277 19277->19260 19280 7ff75c2d9af5 19279->19280 19281 7ff75c2df430 _findclose 11 API calls 19280->19281 19292 7ff75c2d9b2b 19281->19292 19282 7ff75c2d9b33 19283 7ff75c2db1cc __free_lconv_num 11 API calls 19282->19283 19284 7ff75c2d9a2b 19283->19284 19284->19242 19285 7ff75c2d9ba6 19286 7ff75c2db1cc __free_lconv_num 11 API calls 19285->19286 19286->19284 19287 7ff75c2df430 _findclose 11 API calls 19287->19292 19288 7ff75c2d9b95 19290 7ff75c2d9cfc 11 API calls 19288->19290 19289 7ff75c2dacfc __std_exception_copy 37 API calls 19289->19292 19291 7ff75c2d9b9d 19290->19291 19294 7ff75c2db1cc __free_lconv_num 11 API calls 19291->19294 19292->19282 19292->19285 19292->19287 19292->19288 19292->19289 19293 7ff75c2d9bcb 19292->19293 19296 7ff75c2db1cc __free_lconv_num 11 API calls 19292->19296 19295 7ff75c2db184 _wfindfirst32i64 17 API calls 19293->19295 19294->19282 19297 7ff75c2d9bde 19295->19297 19296->19292 19299 7ff75c2dbab5 FlsGetValue 19298->19299 19300 7ff75c2dbad0 FlsSetValue 19298->19300 19301 7ff75c2dbac2 19299->19301 19302 7ff75c2dbaca 19299->19302 19300->19301 19303 7ff75c2dbadd 19300->19303 19304 7ff75c2dbac8 19301->19304 19305 7ff75c2dad5c __CxxCallCatchBlock 45 API calls 19301->19305 19302->19300 19306 7ff75c2df430 _findclose 11 API calls 19303->19306 19318 7ff75c2e2b24 19304->19318 19307 7ff75c2dbb45 19305->19307 19308 7ff75c2dbaec 19306->19308 19309 7ff75c2dbb0a FlsSetValue 19308->19309 19310 7ff75c2dbafa FlsSetValue 19308->19310 19311 7ff75c2dbb16 FlsSetValue 19309->19311 19312 7ff75c2dbb28 19309->19312 19313 7ff75c2dbb03 19310->19313 19311->19313 19314 7ff75c2db778 _findclose 11 API calls 19312->19314 19315 7ff75c2db1cc __free_lconv_num 11 API calls 19313->19315 19316 7ff75c2dbb30 19314->19316 19315->19301 19317 7ff75c2db1cc __free_lconv_num 11 API calls 19316->19317 19317->19304 19341 7ff75c2e2d94 19318->19341 19320 7ff75c2e2b59 19356 7ff75c2e2824 19320->19356 19323 7ff75c2e2b76 19323->19255 19324 7ff75c2dde7c _fread_nolock 12 API calls 19325 7ff75c2e2b87 19324->19325 19326 7ff75c2e2b8f 19325->19326 19328 7ff75c2e2b9e 19325->19328 19327 7ff75c2db1cc __free_lconv_num 11 API calls 19326->19327 19327->19323 19328->19328 19363 7ff75c2e2ecc 19328->19363 19331 7ff75c2e2c9a 19332 7ff75c2d7c48 _findclose 11 API calls 19331->19332 19333 7ff75c2e2c9f 19332->19333 19335 7ff75c2db1cc __free_lconv_num 11 API calls 19333->19335 19334 7ff75c2e2cf5 19337 7ff75c2e2d5c 19334->19337 19374 7ff75c2e2654 19334->19374 19335->19323 19336 7ff75c2e2cb4 19336->19334 19340 7ff75c2db1cc __free_lconv_num 11 API calls 19336->19340 19339 7ff75c2db1cc __free_lconv_num 11 API calls 19337->19339 19339->19323 19340->19334 19342 7ff75c2e2db7 19341->19342 19343 7ff75c2e2dc1 19342->19343 19389 7ff75c2e0ea8 EnterCriticalSection 19342->19389 19345 7ff75c2e2e33 19343->19345 19348 7ff75c2dad5c __CxxCallCatchBlock 45 API calls 19343->19348 19345->19320 19349 7ff75c2e2e4b 19348->19349 19352 7ff75c2e2ea2 19349->19352 19353 7ff75c2dbaa4 50 API calls 19349->19353 19352->19320 19354 7ff75c2e2e8c 19353->19354 19355 7ff75c2e2b24 65 API calls 19354->19355 19355->19352 19357 7ff75c2d5194 45 API calls 19356->19357 19358 7ff75c2e2838 19357->19358 19359 7ff75c2e2844 GetOEMCP 19358->19359 19360 7ff75c2e2856 19358->19360 19361 7ff75c2e286b 19359->19361 19360->19361 19362 7ff75c2e285b GetACP 19360->19362 19361->19323 19361->19324 19362->19361 19364 7ff75c2e2824 47 API calls 19363->19364 19366 7ff75c2e2ef9 19364->19366 19365 7ff75c2e304f 19368 7ff75c2cb190 _wfindfirst32i64 8 API calls 19365->19368 19366->19365 19367 7ff75c2e2f36 IsValidCodePage 19366->19367 19373 7ff75c2e2f50 memcpy_s 19366->19373 19367->19365 19369 7ff75c2e2f47 19367->19369 19370 7ff75c2e2c91 19368->19370 19371 7ff75c2e2f76 GetCPInfo 19369->19371 19369->19373 19370->19331 19370->19336 19371->19365 19371->19373 19390 7ff75c2e293c 19373->19390 19446 7ff75c2e0ea8 EnterCriticalSection 19374->19446 19391 7ff75c2e2979 GetCPInfo 19390->19391 19392 7ff75c2e2a6f 19390->19392 19391->19392 19397 7ff75c2e298c 19391->19397 19393 7ff75c2cb190 _wfindfirst32i64 8 API calls 19392->19393 19394 7ff75c2e2b0e 19393->19394 19394->19365 19395 7ff75c2e36a0 48 API calls 19396 7ff75c2e2a03 19395->19396 19401 7ff75c2e8644 19396->19401 19397->19395 19400 7ff75c2e8644 54 API calls 19400->19392 19402 7ff75c2d5194 45 API calls 19401->19402 19403 7ff75c2e8669 19402->19403 19406 7ff75c2e8310 19403->19406 19407 7ff75c2e8351 19406->19407 19408 7ff75c2dfdf0 _fread_nolock MultiByteToWideChar 19407->19408 19411 7ff75c2e839b 19408->19411 19409 7ff75c2e8619 19410 7ff75c2cb190 _wfindfirst32i64 8 API calls 19409->19410 19412 7ff75c2e2a36 19410->19412 19411->19409 19413 7ff75c2dde7c _fread_nolock 12 API calls 19411->19413 19415 7ff75c2e83d3 19411->19415 19425 7ff75c2e84d1 19411->19425 19412->19400 19413->19415 19414 7ff75c2db1cc __free_lconv_num 11 API calls 19414->19409 19416 7ff75c2dfdf0 _fread_nolock MultiByteToWideChar 19415->19416 19415->19425 19417 7ff75c2e8446 19416->19417 19417->19425 19437 7ff75c2df87c 19417->19437 19420 7ff75c2e8491 19423 7ff75c2df87c __crtLCMapStringW 6 API calls 19420->19423 19420->19425 19421 7ff75c2e84e2 19422 7ff75c2dde7c _fread_nolock 12 API calls 19421->19422 19424 7ff75c2e85b4 19421->19424 19427 7ff75c2e8500 19421->19427 19422->19427 19423->19425 19424->19425 19426 7ff75c2db1cc __free_lconv_num 11 API calls 19424->19426 19425->19409 19425->19414 19426->19425 19427->19425 19428 7ff75c2df87c __crtLCMapStringW 6 API calls 19427->19428 19429 7ff75c2e8580 19428->19429 19429->19424 19430 7ff75c2e85b6 19429->19430 19431 7ff75c2e85a0 19429->19431 19432 7ff75c2e06b8 WideCharToMultiByte 19430->19432 19433 7ff75c2e06b8 WideCharToMultiByte 19431->19433 19434 7ff75c2e85ae 19432->19434 19433->19434 19434->19424 19435 7ff75c2e85ce 19434->19435 19435->19425 19436 7ff75c2db1cc __free_lconv_num 11 API calls 19435->19436 19436->19425 19438 7ff75c2df4a8 __crtLCMapStringW 5 API calls 19437->19438 19439 7ff75c2df8ba 19438->19439 19441 7ff75c2df8c2 19439->19441 19443 7ff75c2df968 19439->19443 19441->19420 19441->19421 19441->19425 19442 7ff75c2df92b LCMapStringW 19442->19441 19444 7ff75c2df4a8 __crtLCMapStringW 5 API calls 19443->19444 19445 7ff75c2df996 __crtLCMapStringW 19444->19445 19445->19442 19448 7ff75c2e6e20 19447->19448 19449 7ff75c2e6e09 19447->19449 19448->19449 19452 7ff75c2e6e2e 19448->19452 19450 7ff75c2d7c48 _findclose 11 API calls 19449->19450 19451 7ff75c2e6e0e 19450->19451 19453 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19451->19453 19454 7ff75c2d5194 45 API calls 19452->19454 19455 7ff75c2e6e19 19452->19455 19453->19455 19454->19455 19455->19129 19457 7ff75c2d5194 45 API calls 19456->19457 19458 7ff75c2e9a39 19457->19458 19461 7ff75c2e9690 19458->19461 19464 7ff75c2e96de 19461->19464 19462 7ff75c2cb190 _wfindfirst32i64 8 API calls 19463 7ff75c2e7cc5 19462->19463 19463->19129 19463->19156 19465 7ff75c2e9765 19464->19465 19467 7ff75c2e9750 GetCPInfo 19464->19467 19470 7ff75c2e9769 19464->19470 19466 7ff75c2dfdf0 _fread_nolock MultiByteToWideChar 19465->19466 19465->19470 19468 7ff75c2e97fd 19466->19468 19467->19465 19467->19470 19469 7ff75c2dde7c _fread_nolock 12 API calls 19468->19469 19468->19470 19471 7ff75c2e9834 19468->19471 19469->19471 19470->19462 19471->19470 19472 7ff75c2dfdf0 _fread_nolock MultiByteToWideChar 19471->19472 19473 7ff75c2e98a2 19472->19473 19474 7ff75c2e9984 19473->19474 19475 7ff75c2dfdf0 _fread_nolock MultiByteToWideChar 19473->19475 19474->19470 19476 7ff75c2db1cc __free_lconv_num 11 API calls 19474->19476 19477 7ff75c2e98c8 19475->19477 19476->19470 19477->19474 19478 7ff75c2dde7c _fread_nolock 12 API calls 19477->19478 19479 7ff75c2e98f5 19477->19479 19478->19479 19479->19474 19480 7ff75c2dfdf0 _fread_nolock MultiByteToWideChar 19479->19480 19481 7ff75c2e996c 19480->19481 19482 7ff75c2e9972 19481->19482 19483 7ff75c2e998c 19481->19483 19482->19474 19485 7ff75c2db1cc __free_lconv_num 11 API calls 19482->19485 19490 7ff75c2df700 19483->19490 19485->19474 19487 7ff75c2e99cb 19487->19470 19489 7ff75c2db1cc __free_lconv_num 11 API calls 19487->19489 19488 7ff75c2db1cc __free_lconv_num 11 API calls 19488->19487 19489->19470 19491 7ff75c2df4a8 __crtLCMapStringW 5 API calls 19490->19491 19492 7ff75c2df73e 19491->19492 19493 7ff75c2df968 __crtLCMapStringW 5 API calls 19492->19493 19495 7ff75c2df746 19492->19495 19494 7ff75c2df7af CompareStringW 19493->19494 19494->19495 19495->19487 19495->19488 19497 7ff75c2e8701 19496->19497 19498 7ff75c2e871a HeapSize 19496->19498 19499 7ff75c2d7c48 _findclose 11 API calls 19497->19499 19500 7ff75c2e8706 19499->19500 19501 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19500->19501 19502 7ff75c2e8711 19501->19502 19502->19160 19504 7ff75c2e10c1 19503->19504 19505 7ff75c2e10cb 19503->19505 19506 7ff75c2dde7c _fread_nolock 12 API calls 19504->19506 19507 7ff75c2e10d0 19505->19507 19513 7ff75c2e10d7 _findclose 19505->19513 19511 7ff75c2e10c9 19506->19511 19510 7ff75c2db1cc __free_lconv_num 11 API calls 19507->19510 19508 7ff75c2e10dd 19512 7ff75c2d7c48 _findclose 11 API calls 19508->19512 19509 7ff75c2e110a HeapReAlloc 19509->19511 19509->19513 19510->19511 19511->19165 19512->19511 19513->19508 19513->19509 19514 7ff75c2e3df0 _findclose 2 API calls 19513->19514 19514->19513 19516 7ff75c2e95f9 __crtLCMapStringW 19515->19516 19517 7ff75c2df700 6 API calls 19516->19517 19518 7ff75c2e7bae 19516->19518 19517->19518 19518->19227 19518->19229 19831 7ff75c2da5a0 19834 7ff75c2da51c 19831->19834 19841 7ff75c2e0ea8 EnterCriticalSection 19834->19841 19842 7ff75c2e1f10 19853 7ff75c2e7ea4 19842->19853 19854 7ff75c2e7eb1 19853->19854 19855 7ff75c2db1cc __free_lconv_num 11 API calls 19854->19855 19857 7ff75c2e7ecd 19854->19857 19855->19854 19856 7ff75c2db1cc __free_lconv_num 11 API calls 19856->19857 19857->19856 19858 7ff75c2e1f19 19857->19858 19859 7ff75c2e0ea8 EnterCriticalSection 19858->19859 15567 7ff75c2ca710 15568 7ff75c2ca73e 15567->15568 15569 7ff75c2ca725 15567->15569 15569->15568 15572 7ff75c2dde7c 15569->15572 15573 7ff75c2ddec7 15572->15573 15577 7ff75c2dde8b _findclose 15572->15577 15582 7ff75c2d7c48 15573->15582 15575 7ff75c2ddeae RtlAllocateHeap 15576 7ff75c2ca79c 15575->15576 15575->15577 15577->15573 15577->15575 15579 7ff75c2e3df0 15577->15579 15585 7ff75c2e3e30 15579->15585 15591 7ff75c2dbb48 GetLastError 15582->15591 15584 7ff75c2d7c51 15584->15576 15590 7ff75c2e0ea8 EnterCriticalSection 15585->15590 15592 7ff75c2dbb6c 15591->15592 15593 7ff75c2dbb89 FlsSetValue 15591->15593 15592->15593 15606 7ff75c2dbb79 SetLastError 15592->15606 15594 7ff75c2dbb9b 15593->15594 15593->15606 15608 7ff75c2df430 15594->15608 15598 7ff75c2dbbc8 FlsSetValue 15601 7ff75c2dbbd4 FlsSetValue 15598->15601 15602 7ff75c2dbbe6 15598->15602 15599 7ff75c2dbbb8 FlsSetValue 15600 7ff75c2dbbc1 15599->15600 15615 7ff75c2db1cc 15600->15615 15601->15600 15621 7ff75c2db778 15602->15621 15606->15584 15613 7ff75c2df441 _findclose 15608->15613 15609 7ff75c2df492 15612 7ff75c2d7c48 _findclose 10 API calls 15609->15612 15610 7ff75c2df476 RtlAllocateHeap 15611 7ff75c2dbbaa 15610->15611 15610->15613 15611->15598 15611->15599 15612->15611 15613->15609 15613->15610 15614 7ff75c2e3df0 _findclose 2 API calls 15613->15614 15614->15613 15616 7ff75c2db1d1 RtlRestoreThreadPreferredUILanguages 15615->15616 15620 7ff75c2db200 15615->15620 15617 7ff75c2db1ec GetLastError 15616->15617 15616->15620 15618 7ff75c2db1f9 __free_lconv_num 15617->15618 15619 7ff75c2d7c48 _findclose 9 API calls 15618->15619 15619->15620 15620->15606 15626 7ff75c2db650 15621->15626 15638 7ff75c2e0ea8 EnterCriticalSection 15626->15638 15640 7ff75c2d8110 15641 7ff75c2d813e 15640->15641 15642 7ff75c2d8177 15640->15642 15643 7ff75c2d7c48 _findclose 11 API calls 15641->15643 15642->15641 15644 7ff75c2d817c FindFirstFileExW 15642->15644 15645 7ff75c2d8143 15643->15645 15646 7ff75c2d81e5 15644->15646 15647 7ff75c2d819e GetLastError 15644->15647 15720 7ff75c2db164 15645->15720 15700 7ff75c2d8380 15646->15700 15650 7ff75c2d81d5 15647->15650 15651 7ff75c2d81a9 15647->15651 15652 7ff75c2d7c48 _findclose 11 API calls 15650->15652 15651->15650 15655 7ff75c2d81b3 15651->15655 15656 7ff75c2d81c5 15651->15656 15668 7ff75c2d814e 15652->15668 15654 7ff75c2d8380 _wfindfirst32i64 10 API calls 15659 7ff75c2d820b 15654->15659 15655->15650 15660 7ff75c2d81b8 15655->15660 15657 7ff75c2d7c48 _findclose 11 API calls 15656->15657 15657->15668 15662 7ff75c2d8380 _wfindfirst32i64 10 API calls 15659->15662 15663 7ff75c2d7c48 _findclose 11 API calls 15660->15663 15664 7ff75c2d8219 15662->15664 15663->15668 15707 7ff75c2e1044 15664->15707 15667 7ff75c2d8243 15716 7ff75c2db184 IsProcessorFeaturePresent 15667->15716 15722 7ff75c2cb190 15668->15722 15701 7ff75c2d839e FileTimeToSystemTime 15700->15701 15702 7ff75c2d8398 15700->15702 15703 7ff75c2d83ad SystemTimeToTzSpecificLocalTime 15701->15703 15705 7ff75c2d83c3 15701->15705 15702->15701 15702->15705 15703->15705 15704 7ff75c2cb190 _wfindfirst32i64 8 API calls 15706 7ff75c2d81fd 15704->15706 15705->15704 15706->15654 15708 7ff75c2e1051 15707->15708 15709 7ff75c2e105b 15707->15709 15708->15709 15713 7ff75c2e1077 15708->15713 15710 7ff75c2d7c48 _findclose 11 API calls 15709->15710 15715 7ff75c2e1063 15710->15715 15711 7ff75c2d8237 15711->15667 15711->15668 15712 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 15712->15711 15713->15711 15714 7ff75c2d7c48 _findclose 11 API calls 15713->15714 15714->15715 15715->15712 15717 7ff75c2db197 15716->15717 15731 7ff75c2dae98 15717->15731 15739 7ff75c2daffc 15720->15739 15723 7ff75c2cb199 15722->15723 15724 7ff75c2cb1a4 15723->15724 15725 7ff75c2cb1f0 IsProcessorFeaturePresent 15723->15725 15726 7ff75c2cb208 15725->15726 15777 7ff75c2cb3e4 RtlCaptureContext 15726->15777 15732 7ff75c2daed2 _wfindfirst32i64 memcpy_s 15731->15732 15733 7ff75c2daefa RtlCaptureContext RtlLookupFunctionEntry 15732->15733 15734 7ff75c2daf34 RtlVirtualUnwind 15733->15734 15735 7ff75c2daf6a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15733->15735 15734->15735 15736 7ff75c2dafbc _wfindfirst32i64 15735->15736 15737 7ff75c2cb190 _wfindfirst32i64 8 API calls 15736->15737 15738 7ff75c2dafdb GetCurrentProcess TerminateProcess 15737->15738 15740 7ff75c2db027 15739->15740 15743 7ff75c2db098 15740->15743 15742 7ff75c2db04e 15751 7ff75c2dade0 15743->15751 15747 7ff75c2db0d3 15747->15742 15749 7ff75c2db184 _wfindfirst32i64 17 API calls 15750 7ff75c2db163 15749->15750 15752 7ff75c2dadfc GetLastError 15751->15752 15753 7ff75c2dae37 15751->15753 15754 7ff75c2dae0c 15752->15754 15753->15747 15757 7ff75c2dae4c 15753->15757 15760 7ff75c2dbc10 15754->15760 15758 7ff75c2dae80 15757->15758 15759 7ff75c2dae68 GetLastError SetLastError 15757->15759 15758->15747 15758->15749 15759->15758 15761 7ff75c2dbc2f FlsGetValue 15760->15761 15762 7ff75c2dbc4a FlsSetValue 15760->15762 15764 7ff75c2dbc44 15761->15764 15766 7ff75c2dae27 SetLastError 15761->15766 15763 7ff75c2dbc57 15762->15763 15762->15766 15765 7ff75c2df430 _findclose 11 API calls 15763->15765 15764->15762 15767 7ff75c2dbc66 15765->15767 15766->15753 15768 7ff75c2dbc84 FlsSetValue 15767->15768 15769 7ff75c2dbc74 FlsSetValue 15767->15769 15771 7ff75c2dbc90 FlsSetValue 15768->15771 15772 7ff75c2dbca2 15768->15772 15770 7ff75c2dbc7d 15769->15770 15773 7ff75c2db1cc __free_lconv_num 11 API calls 15770->15773 15771->15770 15774 7ff75c2db778 _findclose 11 API calls 15772->15774 15773->15766 15775 7ff75c2dbcaa 15774->15775 15776 7ff75c2db1cc __free_lconv_num 11 API calls 15775->15776 15776->15766 15778 7ff75c2cb3fe RtlLookupFunctionEntry 15777->15778 15779 7ff75c2cb414 RtlVirtualUnwind 15778->15779 15780 7ff75c2cb21b 15778->15780 15779->15778 15779->15780 15781 7ff75c2cb1b0 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15780->15781 19547 7ff75c2ead92 19548 7ff75c2eada1 19547->19548 19549 7ff75c2eadab 19547->19549 19551 7ff75c2e0f08 LeaveCriticalSection 19548->19551 19860 7ff75c2d5510 19861 7ff75c2d551b 19860->19861 19869 7ff75c2dfa44 19861->19869 19882 7ff75c2e0ea8 EnterCriticalSection 19869->19882 19890 7ff75c2eacfd 19893 7ff75c2d5578 LeaveCriticalSection 19890->19893 19594 7ff75c2eab77 19595 7ff75c2eab87 19594->19595 19598 7ff75c2d5578 LeaveCriticalSection 19595->19598 19617 7ff75c2cb460 19618 7ff75c2cb470 19617->19618 19634 7ff75c2da3f8 19618->19634 19620 7ff75c2cb47c 19640 7ff75c2cb778 19620->19640 19622 7ff75c2cba5c 7 API calls 19624 7ff75c2cb515 19622->19624 19623 7ff75c2cb494 _RTC_Initialize 19632 7ff75c2cb4e9 19623->19632 19645 7ff75c2cb928 19623->19645 19626 7ff75c2cb4a9 19648 7ff75c2d9868 19626->19648 19632->19622 19633 7ff75c2cb505 19632->19633 19635 7ff75c2da409 19634->19635 19636 7ff75c2da411 19635->19636 19637 7ff75c2d7c48 _findclose 11 API calls 19635->19637 19636->19620 19638 7ff75c2da420 19637->19638 19639 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19638->19639 19639->19636 19641 7ff75c2cb789 19640->19641 19644 7ff75c2cb78e __scrt_release_startup_lock 19640->19644 19642 7ff75c2cba5c 7 API calls 19641->19642 19641->19644 19643 7ff75c2cb802 19642->19643 19644->19623 19673 7ff75c2cb8ec 19645->19673 19647 7ff75c2cb931 19647->19626 19649 7ff75c2d9888 19648->19649 19671 7ff75c2cb4b5 19648->19671 19650 7ff75c2d98a6 GetModuleFileNameW 19649->19650 19651 7ff75c2d9890 19649->19651 19655 7ff75c2d98d1 19650->19655 19652 7ff75c2d7c48 _findclose 11 API calls 19651->19652 19653 7ff75c2d9895 19652->19653 19654 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 19653->19654 19654->19671 19688 7ff75c2d9808 19655->19688 19658 7ff75c2d9919 19659 7ff75c2d7c48 _findclose 11 API calls 19658->19659 19660 7ff75c2d991e 19659->19660 19661 7ff75c2db1cc __free_lconv_num 11 API calls 19660->19661 19661->19671 19662 7ff75c2d9953 19664 7ff75c2db1cc __free_lconv_num 11 API calls 19662->19664 19663 7ff75c2d9931 19663->19662 19665 7ff75c2d997f 19663->19665 19666 7ff75c2d9998 19663->19666 19664->19671 19667 7ff75c2db1cc __free_lconv_num 11 API calls 19665->19667 19669 7ff75c2db1cc __free_lconv_num 11 API calls 19666->19669 19668 7ff75c2d9988 19667->19668 19670 7ff75c2db1cc __free_lconv_num 11 API calls 19668->19670 19669->19662 19670->19671 19671->19632 19672 7ff75c2cb9fc InitializeSListHead 19671->19672 19674 7ff75c2cb906 19673->19674 19676 7ff75c2cb8ff 19673->19676 19677 7ff75c2daa3c 19674->19677 19676->19647 19680 7ff75c2da678 19677->19680 19687 7ff75c2e0ea8 EnterCriticalSection 19680->19687 19689 7ff75c2d9820 19688->19689 19690 7ff75c2d9858 19688->19690 19689->19690 19691 7ff75c2df430 _findclose 11 API calls 19689->19691 19690->19658 19690->19663 19692 7ff75c2d984e 19691->19692 19693 7ff75c2db1cc __free_lconv_num 11 API calls 19692->19693 19693->19690 15865 7ff75c2dfedc 15866 7ff75c2e00ce 15865->15866 15868 7ff75c2dff1e _isindst 15865->15868 15867 7ff75c2d7c48 _findclose 11 API calls 15866->15867 15885 7ff75c2e00be 15867->15885 15868->15866 15871 7ff75c2dff9e _isindst 15868->15871 15869 7ff75c2cb190 _wfindfirst32i64 8 API calls 15870 7ff75c2e00e9 15869->15870 15886 7ff75c2e6af4 15871->15886 15876 7ff75c2e00fa 15877 7ff75c2db184 _wfindfirst32i64 17 API calls 15876->15877 15879 7ff75c2e010e 15877->15879 15883 7ff75c2dfffb 15883->15885 15911 7ff75c2e6b38 15883->15911 15885->15869 15887 7ff75c2e6b03 15886->15887 15888 7ff75c2dffbc 15886->15888 15918 7ff75c2e0ea8 EnterCriticalSection 15887->15918 15893 7ff75c2e5ef8 15888->15893 15894 7ff75c2e5f01 15893->15894 15895 7ff75c2dffd1 15893->15895 15896 7ff75c2d7c48 _findclose 11 API calls 15894->15896 15895->15876 15899 7ff75c2e5f28 15895->15899 15897 7ff75c2e5f06 15896->15897 15898 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 15897->15898 15898->15895 15900 7ff75c2e5f31 15899->15900 15904 7ff75c2dffe2 15899->15904 15901 7ff75c2d7c48 _findclose 11 API calls 15900->15901 15902 7ff75c2e5f36 15901->15902 15903 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 15902->15903 15903->15904 15904->15876 15905 7ff75c2e5f58 15904->15905 15906 7ff75c2e5f61 15905->15906 15908 7ff75c2dfff3 15905->15908 15907 7ff75c2d7c48 _findclose 11 API calls 15906->15907 15909 7ff75c2e5f66 15907->15909 15908->15876 15908->15883 15910 7ff75c2db164 _invalid_parameter_noinfo 37 API calls 15909->15910 15910->15908 15919 7ff75c2e0ea8 EnterCriticalSection 15911->15919

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 310 7ff75c2e6560-7ff75c2e659b call 7ff75c2e5ee8 call 7ff75c2e5ef0 call 7ff75c2e5f58 317 7ff75c2e67c5-7ff75c2e6811 call 7ff75c2db184 call 7ff75c2e5ee8 call 7ff75c2e5ef0 call 7ff75c2e5f58 310->317 318 7ff75c2e65a1-7ff75c2e65ac call 7ff75c2e5ef8 310->318 344 7ff75c2e694f-7ff75c2e69bd call 7ff75c2db184 call 7ff75c2e1dd8 317->344 345 7ff75c2e6817-7ff75c2e6822 call 7ff75c2e5ef8 317->345 318->317 323 7ff75c2e65b2-7ff75c2e65bc 318->323 325 7ff75c2e65de-7ff75c2e65e2 323->325 326 7ff75c2e65be-7ff75c2e65c1 323->326 329 7ff75c2e65e5-7ff75c2e65ed 325->329 328 7ff75c2e65c4-7ff75c2e65cf 326->328 331 7ff75c2e65d1-7ff75c2e65d8 328->331 332 7ff75c2e65da-7ff75c2e65dc 328->332 329->329 333 7ff75c2e65ef-7ff75c2e6602 call 7ff75c2dde7c 329->333 331->328 331->332 332->325 335 7ff75c2e660b-7ff75c2e6619 332->335 340 7ff75c2e6604-7ff75c2e6606 call 7ff75c2db1cc 333->340 341 7ff75c2e661a-7ff75c2e6626 call 7ff75c2db1cc 333->341 340->335 350 7ff75c2e662d-7ff75c2e6635 341->350 364 7ff75c2e69bf-7ff75c2e69c6 344->364 365 7ff75c2e69cb-7ff75c2e69ce 344->365 345->344 355 7ff75c2e6828-7ff75c2e6833 call 7ff75c2e5f28 345->355 350->350 353 7ff75c2e6637-7ff75c2e6648 call 7ff75c2e1044 350->353 353->317 363 7ff75c2e664e-7ff75c2e66a4 call 7ff75c2cc8b0 * 4 call 7ff75c2e647c 353->363 355->344 362 7ff75c2e6839-7ff75c2e685c call 7ff75c2db1cc GetTimeZoneInformation 355->362 377 7ff75c2e6924-7ff75c2e694e call 7ff75c2e5ee0 call 7ff75c2e5ed0 call 7ff75c2e5ed8 362->377 378 7ff75c2e6862-7ff75c2e6883 362->378 423 7ff75c2e66a6-7ff75c2e66aa 363->423 368 7ff75c2e6a5b-7ff75c2e6a5e 364->368 369 7ff75c2e6a05-7ff75c2e6a18 call 7ff75c2dde7c 365->369 370 7ff75c2e69d0 365->370 374 7ff75c2e6a64-7ff75c2e6a6c call 7ff75c2e6560 368->374 375 7ff75c2e69d3 368->375 383 7ff75c2e6a23-7ff75c2e6a3e call 7ff75c2e1dd8 369->383 384 7ff75c2e6a1a 369->384 370->375 381 7ff75c2e69d8-7ff75c2e6a04 call 7ff75c2db1cc call 7ff75c2cb190 374->381 375->381 382 7ff75c2e69d3 call 7ff75c2e67dc 375->382 385 7ff75c2e6885-7ff75c2e688b 378->385 386 7ff75c2e688e-7ff75c2e6895 378->386 382->381 406 7ff75c2e6a45-7ff75c2e6a57 call 7ff75c2db1cc 383->406 407 7ff75c2e6a40-7ff75c2e6a43 383->407 391 7ff75c2e6a1c-7ff75c2e6a21 call 7ff75c2db1cc 384->391 385->386 392 7ff75c2e6897-7ff75c2e689f 386->392 393 7ff75c2e68a9 386->393 391->370 392->393 399 7ff75c2e68a1-7ff75c2e68a7 392->399 403 7ff75c2e68ab-7ff75c2e691f call 7ff75c2cc8b0 * 4 call 7ff75c2e33bc call 7ff75c2e6a74 * 2 393->403 399->403 403->377 406->368 407->391 424 7ff75c2e66b0-7ff75c2e66b4 423->424 425 7ff75c2e66ac 423->425 424->423 427 7ff75c2e66b6-7ff75c2e66db call 7ff75c2d72bc 424->427 425->424 433 7ff75c2e66de-7ff75c2e66e2 427->433 435 7ff75c2e66e4-7ff75c2e66ef 433->435 436 7ff75c2e66f1-7ff75c2e66f5 433->436 435->436 438 7ff75c2e66f7-7ff75c2e66fb 435->438 436->433 441 7ff75c2e677c-7ff75c2e6780 438->441 442 7ff75c2e66fd-7ff75c2e6725 call 7ff75c2d72bc 438->442 443 7ff75c2e6782-7ff75c2e6784 441->443 444 7ff75c2e6787-7ff75c2e6794 441->444 450 7ff75c2e6743-7ff75c2e6747 442->450 451 7ff75c2e6727 442->451 443->444 446 7ff75c2e6796-7ff75c2e67ac call 7ff75c2e647c 444->446 447 7ff75c2e67af-7ff75c2e67be call 7ff75c2e5ee0 call 7ff75c2e5ed0 444->447 446->447 447->317 450->441 453 7ff75c2e6749-7ff75c2e6767 call 7ff75c2d72bc 450->453 455 7ff75c2e672a-7ff75c2e6731 451->455 462 7ff75c2e6773-7ff75c2e677a 453->462 455->450 458 7ff75c2e6733-7ff75c2e6741 455->458 458->450 458->455 462->441 463 7ff75c2e6769-7ff75c2e676d 462->463 463->441 464 7ff75c2e676f 463->464 464->462
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E65A5
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2E5EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2E5F0C
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB1CC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1E2
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB1CC: GetLastError.KERNEL32(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1EC
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB184: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF75C2DB163,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DB18D
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB184: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF75C2DB163,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DB1B2
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E6594
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2E5F58: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2E5F6C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E680A
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E681B
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E682C
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF75C2E6A6C), ref: 00007FF75C2E6853
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                                                                                                                                                                                                            • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                                                            • API String ID: 1458651798-690618308
                                                                                                                                                                                                                            • Opcode ID: 0992fc228e43ad0e5175039d5836c994e019806c4e98bfffcd809552ce95d6a9
                                                                                                                                                                                                                            • Instruction ID: c6ff7cdf481e7b8d40373ab0410c13291787e1125b645c815c3b294b5224341b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0992fc228e43ad0e5175039d5836c994e019806c4e98bfffcd809552ce95d6a9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 14D1AE27E1825686EB20FF36D8907B9A661EF84794F88813AEA0D57785DF3CE441C760

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetTempPathW.KERNEL32(00000000,00000000,00000000,00000000,?,00007FF75C2C154F), ref: 00007FF75C2C6BE7
                                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 00007FF75C2C6BED
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C6D60: GetEnvironmentVariableW.KERNEL32(00007FF75C2C2B3C), ref: 00007FF75C2C6D9A
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C6D60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF75C2C6DB7
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2D80B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2D80C9
                                                                                                                                                                                                                            • SetEnvironmentVariableW.KERNEL32 ref: 00007FF75C2C6CA1
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                            • API String ID: 1556224225-1116378104
                                                                                                                                                                                                                            • Opcode ID: 2087be102ef6a1c91b4f8cbb40ed6e936fe1fe828dd8b56b85001afd848b68ff
                                                                                                                                                                                                                            • Instruction ID: b32a3b187f6d56b92713c4e7c595491745f9327e52751146ba94d369c62f4ab8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2087be102ef6a1c91b4f8cbb40ed6e936fe1fe828dd8b56b85001afd848b68ff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9351B353B0D25361FE54B736A8153BAC2915F95BC0FCC8439ED0E5BB9AED6CE1028360

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 564 7ff75c2e74ac-7ff75c2e751f call 7ff75c2e71e0 567 7ff75c2e7521-7ff75c2e752a call 7ff75c2d7c28 564->567 568 7ff75c2e7539-7ff75c2e7543 call 7ff75c2d86f8 564->568 575 7ff75c2e752d-7ff75c2e7534 call 7ff75c2d7c48 567->575 573 7ff75c2e7545-7ff75c2e755c call 7ff75c2d7c28 call 7ff75c2d7c48 568->573 574 7ff75c2e755e-7ff75c2e75c7 CreateFileW 568->574 573->575 578 7ff75c2e7644-7ff75c2e764f GetFileType 574->578 579 7ff75c2e75c9-7ff75c2e75cf 574->579 586 7ff75c2e787a-7ff75c2e789a 575->586 581 7ff75c2e76a2-7ff75c2e76a9 578->581 582 7ff75c2e7651-7ff75c2e768c GetLastError call 7ff75c2d7bbc CloseHandle 578->582 584 7ff75c2e7611-7ff75c2e763f GetLastError call 7ff75c2d7bbc 579->584 585 7ff75c2e75d1-7ff75c2e75d5 579->585 589 7ff75c2e76b1-7ff75c2e76b4 581->589 590 7ff75c2e76ab-7ff75c2e76af 581->590 582->575 598 7ff75c2e7692-7ff75c2e769d call 7ff75c2d7c48 582->598 584->575 585->584 591 7ff75c2e75d7-7ff75c2e760f CreateFileW 585->591 596 7ff75c2e76ba-7ff75c2e770f call 7ff75c2d8610 589->596 597 7ff75c2e76b6 589->597 590->596 591->578 591->584 603 7ff75c2e7711-7ff75c2e771d call 7ff75c2e73e8 596->603 604 7ff75c2e772e-7ff75c2e775f call 7ff75c2e6f60 596->604 597->596 598->575 603->604 609 7ff75c2e771f 603->609 610 7ff75c2e7765-7ff75c2e77a7 604->610 611 7ff75c2e7761-7ff75c2e7763 604->611 612 7ff75c2e7721-7ff75c2e7729 call 7ff75c2db344 609->612 613 7ff75c2e77c9-7ff75c2e77d4 610->613 614 7ff75c2e77a9-7ff75c2e77ad 610->614 611->612 612->586 617 7ff75c2e7878 613->617 618 7ff75c2e77da-7ff75c2e77de 613->618 614->613 616 7ff75c2e77af-7ff75c2e77c4 614->616 616->613 617->586 618->617 620 7ff75c2e77e4-7ff75c2e7829 CloseHandle CreateFileW 618->620 621 7ff75c2e782b-7ff75c2e7859 GetLastError call 7ff75c2d7bbc call 7ff75c2d8838 620->621 622 7ff75c2e785e-7ff75c2e7873 620->622 621->622 622->617
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1617910340-0
                                                                                                                                                                                                                            • Opcode ID: 8afc4846cd620552121b56385621ad3827c937315e643adb1c03d6c87c062f34
                                                                                                                                                                                                                            • Instruction ID: 8f36089970d3b3e7c2f14561f22475c22453dbe8d9e974f91cd1cc3cf734ee2c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8afc4846cd620552121b56385621ad3827c937315e643adb1c03d6c87c062f34
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12C1D233B24A4285EB50DF79C4902BC7771EB59B98B491239DE2EA7398CF38D055C350

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 826 7ff75c2e67dc-7ff75c2e6811 call 7ff75c2e5ee8 call 7ff75c2e5ef0 call 7ff75c2e5f58 833 7ff75c2e694f-7ff75c2e69bd call 7ff75c2db184 call 7ff75c2e1dd8 826->833 834 7ff75c2e6817-7ff75c2e6822 call 7ff75c2e5ef8 826->834 846 7ff75c2e69bf-7ff75c2e69c6 833->846 847 7ff75c2e69cb-7ff75c2e69ce 833->847 834->833 840 7ff75c2e6828-7ff75c2e6833 call 7ff75c2e5f28 834->840 840->833 845 7ff75c2e6839-7ff75c2e685c call 7ff75c2db1cc GetTimeZoneInformation 840->845 857 7ff75c2e6924-7ff75c2e694e call 7ff75c2e5ee0 call 7ff75c2e5ed0 call 7ff75c2e5ed8 845->857 858 7ff75c2e6862-7ff75c2e6883 845->858 849 7ff75c2e6a5b-7ff75c2e6a5e 846->849 850 7ff75c2e6a05-7ff75c2e6a18 call 7ff75c2dde7c 847->850 851 7ff75c2e69d0 847->851 854 7ff75c2e6a64-7ff75c2e6a6c call 7ff75c2e6560 849->854 855 7ff75c2e69d3 849->855 862 7ff75c2e6a23-7ff75c2e6a3e call 7ff75c2e1dd8 850->862 863 7ff75c2e6a1a 850->863 851->855 860 7ff75c2e69d8-7ff75c2e6a04 call 7ff75c2db1cc call 7ff75c2cb190 854->860 855->860 861 7ff75c2e69d3 call 7ff75c2e67dc 855->861 864 7ff75c2e6885-7ff75c2e688b 858->864 865 7ff75c2e688e-7ff75c2e6895 858->865 861->860 882 7ff75c2e6a45-7ff75c2e6a57 call 7ff75c2db1cc 862->882 883 7ff75c2e6a40-7ff75c2e6a43 862->883 869 7ff75c2e6a1c-7ff75c2e6a21 call 7ff75c2db1cc 863->869 864->865 870 7ff75c2e6897-7ff75c2e689f 865->870 871 7ff75c2e68a9 865->871 869->851 870->871 876 7ff75c2e68a1-7ff75c2e68a7 870->876 879 7ff75c2e68ab-7ff75c2e691f call 7ff75c2cc8b0 * 4 call 7ff75c2e33bc call 7ff75c2e6a74 * 2 871->879 876->879 879->857 882->849 883->869
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E680A
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2E5F58: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2E5F6C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E681B
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2E5EF8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2E5F0C
                                                                                                                                                                                                                            • _get_daylight.LIBCMT ref: 00007FF75C2E682C
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2E5F28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2E5F3C
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB1CC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1E2
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB1CC: GetLastError.KERNEL32(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1EC
                                                                                                                                                                                                                            • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF75C2E6A6C), ref: 00007FF75C2E6853
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                                                                                                                                                                                                            • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                                                            • API String ID: 2248164782-690618308
                                                                                                                                                                                                                            • Opcode ID: db174c4128b3a7a4552f986b7bba05e7d482cfcee159e29a1967446997e4cdde
                                                                                                                                                                                                                            • Instruction ID: 032e284bd81b04b6f8c99f6f1e171cc676f7ac0571d8478e8cfbc1da54df25b4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: db174c4128b3a7a4552f986b7bba05e7d482cfcee159e29a1967446997e4cdde
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 38518E33A1864686E710FF31E8916B9F764BB88784F88913EEA4D93795DF3CE4418760
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2295610775-0
                                                                                                                                                                                                                            • Opcode ID: 11c8737c5447c46409b4ad6f1658ea81d4cf5819c889836a1f8e1472af053c13
                                                                                                                                                                                                                            • Instruction ID: acdb939bc73dab39a24c77260a8b5b04ca372f5e90646c1c384092d1017c2cad
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 11c8737c5447c46409b4ad6f1658ea81d4cf5819c889836a1f8e1472af053c13
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2FF08123A1C6858AF7A09F74E499766B360AB54724F880239D66D467D4EF7CD008CB14

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 0 7ff75c2c1710-7ff75c2c1724 1 7ff75c2c1726-7ff75c2c173d call 7ff75c2c2010 0->1 2 7ff75c2c173e-7ff75c2c1742 0->2 4 7ff75c2c1744-7ff75c2c174d call 7ff75c2c12b0 2->4 5 7ff75c2c1768-7ff75c2c178b call 7ff75c2c6e10 2->5 13 7ff75c2c175f-7ff75c2c1767 4->13 14 7ff75c2c174f-7ff75c2c175a call 7ff75c2c2010 4->14 11 7ff75c2c17b9-7ff75c2c17d4 call 7ff75c2c31a0 5->11 12 7ff75c2c178d-7ff75c2c17b8 call 7ff75c2c1fd0 5->12 20 7ff75c2c17d6-7ff75c2c17e9 call 7ff75c2c2010 11->20 21 7ff75c2c17ee-7ff75c2c1801 call 7ff75c2cfcd4 11->21 14->13 26 7ff75c2c192f-7ff75c2c1932 call 7ff75c2cf64c 20->26 27 7ff75c2c1823-7ff75c2c1827 21->27 28 7ff75c2c1803-7ff75c2c181e call 7ff75c2c1fd0 21->28 33 7ff75c2c1937-7ff75c2c194e 26->33 30 7ff75c2c1841-7ff75c2c1861 call 7ff75c2d518c 27->30 31 7ff75c2c1829-7ff75c2c1835 call 7ff75c2c1050 27->31 37 7ff75c2c1927-7ff75c2c192a call 7ff75c2cf64c 28->37 40 7ff75c2c1882-7ff75c2c1888 30->40 41 7ff75c2c1863-7ff75c2c187d call 7ff75c2c1fd0 30->41 38 7ff75c2c183a-7ff75c2c183c 31->38 37->26 38->37 44 7ff75c2c1915-7ff75c2c1918 call 7ff75c2d5178 40->44 45 7ff75c2c188e-7ff75c2c1897 40->45 49 7ff75c2c191d-7ff75c2c1922 41->49 44->49 48 7ff75c2c18a0-7ff75c2c18c2 call 7ff75c2cf99c 45->48 52 7ff75c2c18f5-7ff75c2c18fc 48->52 53 7ff75c2c18c4-7ff75c2c18dc call 7ff75c2d00dc 48->53 49->37 55 7ff75c2c1903-7ff75c2c190b call 7ff75c2c1fd0 52->55 58 7ff75c2c18e5-7ff75c2c18f3 53->58 59 7ff75c2c18de-7ff75c2c18e1 53->59 62 7ff75c2c1910 55->62 58->55 59->48 61 7ff75c2c18e3 59->61 61->62 62->44
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                                                                                                                                                                            • API String ID: 0-3833288071
                                                                                                                                                                                                                            • Opcode ID: 01d685271b9e8706579282155b7ce4b0c70d288296d5f0463d67d3dc85306169
                                                                                                                                                                                                                            • Instruction ID: 677ff2730ae03b9428ce6f52803c39ae5bb0bbbc97f2cc0de91ed040aaf64d9c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 01d685271b9e8706579282155b7ce4b0c70d288296d5f0463d67d3dc85306169
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42519C63B0C642A2EA10BB32E8513B9A351AF45794FC84135DE0C47B96DF7CE148C724

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 63 7ff75c2c1000-7ff75c2c2afb call 7ff75c2cf420 call 7ff75c2cf418 call 7ff75c2c7910 call 7ff75c2cb130 call 7ff75c2d54f0 call 7ff75c2d60c0 call 7ff75c2c1eb0 79 7ff75c2c2b01-7ff75c2c2b11 call 7ff75c2c3090 63->79 80 7ff75c2c2be6 63->80 79->80 86 7ff75c2c2b17-7ff75c2c2b2a call 7ff75c2c2f60 79->86 81 7ff75c2c2beb-7ff75c2c2c14 call 7ff75c2cb190 80->81 86->80 89 7ff75c2c2b30-7ff75c2c2b4e call 7ff75c2c6d60 86->89 92 7ff75c2c2b90-7ff75c2c2bb0 call 7ff75c2c7240 call 7ff75c2c1cb0 89->92 93 7ff75c2c2b50-7ff75c2c2b5f call 7ff75c2c6d60 89->93 104 7ff75c2c2bb6-7ff75c2c2bcc call 7ff75c2c1cb0 92->104 105 7ff75c2c2c8e-7ff75c2c2ca3 call 7ff75c2c1a00 92->105 93->92 98 7ff75c2c2b61-7ff75c2c2b67 93->98 100 7ff75c2c2b73-7ff75c2c2b8d call 7ff75c2d5178 call 7ff75c2c7240 98->100 101 7ff75c2c2b69-7ff75c2c2b71 98->101 100->92 101->100 112 7ff75c2c2c15-7ff75c2c2c18 104->112 113 7ff75c2c2bce-7ff75c2c2be1 call 7ff75c2c2010 104->113 115 7ff75c2c2ca5-7ff75c2c2cb6 call 7ff75c2d6100 105->115 116 7ff75c2c2cd7-7ff75c2c2ce8 105->116 112->105 120 7ff75c2c2c1a-7ff75c2c2c31 call 7ff75c2c31a0 112->120 113->80 131 7ff75c2c2cbf-7ff75c2c2cd0 call 7ff75c2d6100 115->131 132 7ff75c2c2cb8-7ff75c2c2cbd call 7ff75c2c7ab0 115->132 118 7ff75c2c2d04-7ff75c2c2d07 116->118 119 7ff75c2c2cea-7ff75c2c2cf1 116->119 123 7ff75c2c2d09-7ff75c2c2d10 118->123 124 7ff75c2c2d1e-7ff75c2c2d36 call 7ff75c2c7fb0 118->124 119->118 122 7ff75c2c2cf3-7ff75c2c2cf6 call 7ff75c2c14f0 119->122 137 7ff75c2c2c33-7ff75c2c2c36 120->137 138 7ff75c2c2c38-7ff75c2c2c64 call 7ff75c2c74b0 120->138 136 7ff75c2c2cfb-7ff75c2c2cfe 122->136 128 7ff75c2c2d12-7ff75c2c2d1c 123->128 129 7ff75c2c2d56-7ff75c2c2d63 call 7ff75c2c5fe0 123->129 146 7ff75c2c2d49-7ff75c2c2d50 SetDllDirectoryW 124->146 147 7ff75c2c2d38-7ff75c2c2d44 call 7ff75c2c2010 124->147 128->124 128->129 151 7ff75c2c2d65-7ff75c2c2d72 call 7ff75c2c5c90 129->151 152 7ff75c2c2dae-7ff75c2c2db3 call 7ff75c2c5f60 129->152 131->116 149 7ff75c2c2cd2 call 7ff75c2c7c00 131->149 132->116 136->80 136->118 143 7ff75c2c2c73-7ff75c2c2c89 call 7ff75c2c2010 137->143 138->105 154 7ff75c2c2c66-7ff75c2c2c6e call 7ff75c2cf64c 138->154 143->80 146->129 147->80 149->116 151->152 166 7ff75c2c2d74-7ff75c2c2d83 call 7ff75c2c57f0 151->166 161 7ff75c2c2db8-7ff75c2c2dbb 152->161 154->143 164 7ff75c2c2dc1-7ff75c2c2dcf 161->164 165 7ff75c2c2e9d-7ff75c2c2eac call 7ff75c2c26d0 161->165 167 7ff75c2c2dd0-7ff75c2c2dda 164->167 165->80 174 7ff75c2c2eb2-7ff75c2c2ed9 call 7ff75c2c71d0 call 7ff75c2c6d60 call 7ff75c2c2830 165->174 177 7ff75c2c2d85-7ff75c2c2d91 call 7ff75c2c5770 166->177 178 7ff75c2c2da4-7ff75c2c2da9 call 7ff75c2c5a40 166->178 170 7ff75c2c2de3-7ff75c2c2de5 167->170 171 7ff75c2c2ddc-7ff75c2c2de1 167->171 175 7ff75c2c2e31-7ff75c2c2e34 170->175 176 7ff75c2c2de7-7ff75c2c2e0a call 7ff75c2c1ef0 170->176 171->167 171->170 210 7ff75c2c2f0d-7ff75c2c2f3d call 7ff75c2c7280 call 7ff75c2c5a40 call 7ff75c2c5f60 174->210 211 7ff75c2c2edb-7ff75c2c2eec call 7ff75c2d6100 174->211 179 7ff75c2c2e36-7ff75c2c2e47 call 7ff75c2d6100 175->179 180 7ff75c2c2e68-7ff75c2c2e98 call 7ff75c2c2830 call 7ff75c2c2670 call 7ff75c2c2820 call 7ff75c2c5a40 call 7ff75c2c5f60 175->180 176->80 193 7ff75c2c2e10-7ff75c2c2e1a 176->193 177->178 194 7ff75c2c2d93-7ff75c2c2da2 call 7ff75c2c5e30 177->194 178->152 196 7ff75c2c2e50-7ff75c2c2e61 call 7ff75c2d6100 179->196 197 7ff75c2c2e49-7ff75c2c2e4e call 7ff75c2c7ab0 179->197 180->81 200 7ff75c2c2e20-7ff75c2c2e2f 193->200 194->161 196->180 213 7ff75c2c2e63 call 7ff75c2c7c00 196->213 197->180 200->175 200->200 234 7ff75c2c2f3f-7ff75c2c2f46 call 7ff75c2c6f40 210->234 235 7ff75c2c2f4b-7ff75c2c2f4e call 7ff75c2c1e80 210->235 221 7ff75c2c2ef5-7ff75c2c2f06 call 7ff75c2d6100 211->221 222 7ff75c2c2eee-7ff75c2c2ef3 call 7ff75c2c7ab0 211->222 213->180 221->210 233 7ff75c2c2f08 call 7ff75c2c7c00 221->233 222->210 233->210 234->235 239 7ff75c2c2f53-7ff75c2c2f55 235->239 239->81
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C3090: GetModuleFileNameW.KERNEL32(?,00007FF75C2C2B0F), ref: 00007FF75C2C30C1
                                                                                                                                                                                                                            • SetDllDirectoryW.KERNEL32 ref: 00007FF75C2C2D50
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C6D60: GetEnvironmentVariableW.KERNEL32(00007FF75C2C2B3C), ref: 00007FF75C2C6D9A
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C6D60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF75C2C6DB7
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                            • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE$hide-early$hide-late$minimize-early$minimize-late$pyi-hide-console
                                                                                                                                                                                                                            • API String ID: 2344891160-1364127678
                                                                                                                                                                                                                            • Opcode ID: 8f76b5c42b7e746e634dfe7dd954cccf2ebd249b4f6bb50f5bb71d8f7b22996e
                                                                                                                                                                                                                            • Instruction ID: f5fedfd8dc08e75177cfee916109286a4388a6cbbd114277e80c025b06d2d7af
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f76b5c42b7e746e634dfe7dd954cccf2ebd249b4f6bb50f5bb71d8f7b22996e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C1D1A023A1C64361FA64BB3599513F9E290AF94784FCC0035EA0D97796EF6CE605CB70

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32(0000000100000001,00007FF75C2C331C,00007FF75C2C6B11,?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7CA0
                                                                                                                                                                                                                            • OpenProcessToken.ADVAPI32(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7CB1
                                                                                                                                                                                                                            • GetTokenInformation.KERNELBASE(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7CD3
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7CDD
                                                                                                                                                                                                                            • GetTokenInformation.KERNELBASE(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7D1A
                                                                                                                                                                                                                            • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF75C2C7D2C
                                                                                                                                                                                                                            • FindCloseChangeNotification.KERNELBASE(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7D44
                                                                                                                                                                                                                            • LocalFree.KERNEL32(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7D76
                                                                                                                                                                                                                            • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF75C2C7D9D
                                                                                                                                                                                                                            • CreateDirectoryW.KERNELBASE(?,00007FF75C2C6F26,?,00007FF75C2C1785), ref: 00007FF75C2C7DAE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
                                                                                                                                                                                                                            • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                            • API String ID: 2187719417-2855260032
                                                                                                                                                                                                                            • Opcode ID: c49b53b47b33b28df59b0cea2bd685458743d024825b2f4c4d8a6a27e68c54cf
                                                                                                                                                                                                                            • Instruction ID: 47715477a8c63f14dc0233e3acd1ed8fbe1442e31fe1660346c283b38b9f5c12
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c49b53b47b33b28df59b0cea2bd685458743d024825b2f4c4d8a6a27e68c54cf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 58417233618B8692E750AB34E4447BAA361FB84790F880235EA5E877D4DF7CE508C760

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock
                                                                                                                                                                                                                            • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 840049012-1384898525
                                                                                                                                                                                                                            • Opcode ID: 40f9c4fe11d6c2f80db9b598c6f9663cfe96eb1559f56d9584adfd04f12d05a3
                                                                                                                                                                                                                            • Instruction ID: 5429cf08fffe78cee3c85f1dc0e15dc9c3e3844221ec155acb661ee3cbcc22f7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 40f9c4fe11d6c2f80db9b598c6f9663cfe96eb1559f56d9584adfd04f12d05a3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7851B173A0970296EB14EF3AE441378B3A0EF48B84F994035DA0C877A9DE7CE544CB64

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                            • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                            • API String ID: 2895956056-3524285272
                                                                                                                                                                                                                            • Opcode ID: 09cdf26451e21f988e1d62598cc136331b4b0f50e0bb1119a682d216b8410746
                                                                                                                                                                                                                            • Instruction ID: 59903cead15a66fa97e6ed1920ff58d000f0b41c87fab5a7cb7bbbc7b49b9699
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 09cdf26451e21f988e1d62598cc136331b4b0f50e0bb1119a682d216b8410746
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 23414333A0878282DA60AB34E4553AAF3A4FB94764F940339E6AD43BD9DF7CD0458B50

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 627 7ff75c2c1050-7ff75c2c10ab call 7ff75c2ca9b0 630 7ff75c2c10d3-7ff75c2c10eb call 7ff75c2d518c 627->630 631 7ff75c2c10ad-7ff75c2c10d2 call 7ff75c2c2010 627->631 636 7ff75c2c1109-7ff75c2c1119 call 7ff75c2d518c 630->636 637 7ff75c2c10ed-7ff75c2c1104 call 7ff75c2c1fd0 630->637 643 7ff75c2c1137-7ff75c2c1147 636->643 644 7ff75c2c111b-7ff75c2c1132 call 7ff75c2c1fd0 636->644 642 7ff75c2c126c-7ff75c2c1281 call 7ff75c2ca690 call 7ff75c2d5178 * 2 637->642 660 7ff75c2c1286-7ff75c2c12a0 642->660 646 7ff75c2c1150-7ff75c2c1175 call 7ff75c2cf99c 643->646 644->642 653 7ff75c2c125e 646->653 654 7ff75c2c117b-7ff75c2c1185 call 7ff75c2cf710 646->654 656 7ff75c2c1264 653->656 654->653 661 7ff75c2c118b-7ff75c2c1197 654->661 656->642 662 7ff75c2c11a0-7ff75c2c11c8 call 7ff75c2c8e60 661->662 665 7ff75c2c1241-7ff75c2c125c call 7ff75c2c2010 662->665 666 7ff75c2c11ca-7ff75c2c11cd 662->666 665->656 668 7ff75c2c11cf-7ff75c2c11d9 666->668 669 7ff75c2c123c 666->669 671 7ff75c2c1203-7ff75c2c1206 668->671 672 7ff75c2c11db-7ff75c2c11e8 call 7ff75c2d00dc 668->672 669->665 674 7ff75c2c1219-7ff75c2c121e 671->674 675 7ff75c2c1208-7ff75c2c1216 call 7ff75c2cbef0 671->675 676 7ff75c2c11ed-7ff75c2c11f0 672->676 674->662 678 7ff75c2c1220-7ff75c2c1223 674->678 675->674 679 7ff75c2c11f2-7ff75c2c11fc call 7ff75c2cf710 676->679 680 7ff75c2c11fe-7ff75c2c1201 676->680 682 7ff75c2c1225-7ff75c2c1228 678->682 683 7ff75c2c1237-7ff75c2c123a 678->683 679->674 679->680 680->665 682->665 685 7ff75c2c122a-7ff75c2c1232 682->685 683->656 685->646
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                            • API String ID: 0-1655038675
                                                                                                                                                                                                                            • Opcode ID: 796844992ad0ae0c37d0c4fbc41a8f7c79d8bd8a23177e062cabe6813e676bdd
                                                                                                                                                                                                                            • Instruction ID: fa4b40ca8e920b102dd4db474259ee774b32ffb2bdbdfa64d671678ad15fc426
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 796844992ad0ae0c37d0c4fbc41a8f7c79d8bd8a23177e062cabe6813e676bdd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FC51E423A0C682A5EA60BB36E4413BAE2A1FB85794FCC4135DE4D87795EF3CE505C720

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF75C2DF842,?,?,-00000018,00007FF75C2DB5D7,?,?,?,00007FF75C2DB4CE,?,?,?,00007FF75C2D66A2), ref: 00007FF75C2DF624
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF75C2DF842,?,?,-00000018,00007FF75C2DB5D7,?,?,?,00007FF75C2DB4CE,?,?,?,00007FF75C2D66A2), ref: 00007FF75C2DF630
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                            • API String ID: 3013587201-537541572
                                                                                                                                                                                                                            • Opcode ID: ae5708f04b36c8c590ee3721b0de7d7d793178a269120fac9f1ca8338cf688ab
                                                                                                                                                                                                                            • Instruction ID: 61353466931774e16b1388b8fff15b1b884272a40725661e68d7bf47ca2f8e17
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ae5708f04b36c8c590ee3721b0de7d7d793178a269120fac9f1ca8338cf688ab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 84412427B2D60281FA52EF369800775A390BF54BA0FCC4135DD1D9B788EE3CE44A8328

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 713 7ff75c2dc2dc-7ff75c2dc302 714 7ff75c2dc304-7ff75c2dc318 call 7ff75c2d7c28 call 7ff75c2d7c48 713->714 715 7ff75c2dc31d-7ff75c2dc321 713->715 733 7ff75c2dc70e 714->733 717 7ff75c2dc6f7-7ff75c2dc703 call 7ff75c2d7c28 call 7ff75c2d7c48 715->717 718 7ff75c2dc327-7ff75c2dc32e 715->718 735 7ff75c2dc709 call 7ff75c2db164 717->735 718->717 720 7ff75c2dc334-7ff75c2dc362 718->720 720->717 724 7ff75c2dc368-7ff75c2dc36f 720->724 725 7ff75c2dc371-7ff75c2dc383 call 7ff75c2d7c28 call 7ff75c2d7c48 724->725 726 7ff75c2dc388-7ff75c2dc38b 724->726 725->735 731 7ff75c2dc6f3-7ff75c2dc6f5 726->731 732 7ff75c2dc391-7ff75c2dc397 726->732 736 7ff75c2dc711-7ff75c2dc728 731->736 732->731 737 7ff75c2dc39d-7ff75c2dc3a0 732->737 733->736 735->733 737->725 740 7ff75c2dc3a2-7ff75c2dc3c7 737->740 742 7ff75c2dc3fa-7ff75c2dc401 740->742 743 7ff75c2dc3c9-7ff75c2dc3cb 740->743 744 7ff75c2dc403-7ff75c2dc42b call 7ff75c2dde7c call 7ff75c2db1cc * 2 742->744 745 7ff75c2dc3d6-7ff75c2dc3ed call 7ff75c2d7c28 call 7ff75c2d7c48 call 7ff75c2db164 742->745 746 7ff75c2dc3f2-7ff75c2dc3f8 743->746 747 7ff75c2dc3cd-7ff75c2dc3d4 743->747 776 7ff75c2dc42d-7ff75c2dc443 call 7ff75c2d7c48 call 7ff75c2d7c28 744->776 777 7ff75c2dc448-7ff75c2dc473 call 7ff75c2dcb04 744->777 774 7ff75c2dc580 745->774 748 7ff75c2dc478-7ff75c2dc48f 746->748 747->745 747->746 751 7ff75c2dc491-7ff75c2dc499 748->751 752 7ff75c2dc50a-7ff75c2dc514 call 7ff75c2e417c 748->752 751->752 755 7ff75c2dc49b-7ff75c2dc49d 751->755 763 7ff75c2dc59e 752->763 764 7ff75c2dc51a-7ff75c2dc52f 752->764 755->752 759 7ff75c2dc49f-7ff75c2dc4b5 755->759 759->752 766 7ff75c2dc4b7-7ff75c2dc4c3 759->766 772 7ff75c2dc5a3-7ff75c2dc5c3 ReadFile 763->772 764->763 768 7ff75c2dc531-7ff75c2dc543 GetConsoleMode 764->768 766->752 770 7ff75c2dc4c5-7ff75c2dc4c7 766->770 768->763 773 7ff75c2dc545-7ff75c2dc54d 768->773 770->752 775 7ff75c2dc4c9-7ff75c2dc4e1 770->775 778 7ff75c2dc6bd-7ff75c2dc6c6 GetLastError 772->778 779 7ff75c2dc5c9-7ff75c2dc5d1 772->779 773->772 781 7ff75c2dc54f-7ff75c2dc571 ReadConsoleW 773->781 784 7ff75c2dc583-7ff75c2dc58d call 7ff75c2db1cc 774->784 775->752 785 7ff75c2dc4e3-7ff75c2dc4ef 775->785 776->774 777->748 782 7ff75c2dc6e3-7ff75c2dc6e6 778->782 783 7ff75c2dc6c8-7ff75c2dc6de call 7ff75c2d7c48 call 7ff75c2d7c28 778->783 779->778 787 7ff75c2dc5d7 779->787 790 7ff75c2dc573 GetLastError 781->790 791 7ff75c2dc592-7ff75c2dc59c 781->791 795 7ff75c2dc6ec-7ff75c2dc6ee 782->795 796 7ff75c2dc579-7ff75c2dc57b call 7ff75c2d7bbc 782->796 783->774 784->736 785->752 794 7ff75c2dc4f1-7ff75c2dc4f3 785->794 788 7ff75c2dc5de-7ff75c2dc5f3 787->788 788->784 798 7ff75c2dc5f5-7ff75c2dc600 788->798 790->796 791->788 794->752 802 7ff75c2dc4f5-7ff75c2dc505 794->802 795->784 796->774 804 7ff75c2dc602-7ff75c2dc61b call 7ff75c2dbef4 798->804 805 7ff75c2dc627-7ff75c2dc62f 798->805 802->752 813 7ff75c2dc620-7ff75c2dc622 804->813 809 7ff75c2dc631-7ff75c2dc643 805->809 810 7ff75c2dc6ab-7ff75c2dc6b8 call 7ff75c2dbd34 805->810 814 7ff75c2dc645 809->814 815 7ff75c2dc69e-7ff75c2dc6a6 809->815 810->813 813->784 817 7ff75c2dc64a-7ff75c2dc651 814->817 815->784 818 7ff75c2dc653-7ff75c2dc657 817->818 819 7ff75c2dc68d-7ff75c2dc698 817->819 820 7ff75c2dc673 818->820 821 7ff75c2dc659-7ff75c2dc660 818->821 819->815 823 7ff75c2dc679-7ff75c2dc689 820->823 821->820 822 7ff75c2dc662-7ff75c2dc666 821->822 822->820 824 7ff75c2dc668-7ff75c2dc671 822->824 823->817 825 7ff75c2dc68b 823->825 824->823 825->815
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 3aac8c1df359aa8ad0138161e1254d396fa891c01af46540a64807a88d95b6ef
                                                                                                                                                                                                                            • Instruction ID: c8d6ab2b295840a8841b0384e280004c571a97c74b4b640f879b091aae6fe7f0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3aac8c1df359aa8ad0138161e1254d396fa891c01af46540a64807a88d95b6ef
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 78C1F52391C78681E7A16B3594003BDBBA0EFA1B90FDD5131EA4E07399DF7CE8468760

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 936 7ff75c2dd7e0-7ff75c2dd805 937 7ff75c2ddad3 936->937 938 7ff75c2dd80b-7ff75c2dd80e 936->938 939 7ff75c2ddad5-7ff75c2ddae5 937->939 940 7ff75c2dd810-7ff75c2dd842 call 7ff75c2db098 938->940 941 7ff75c2dd847-7ff75c2dd873 938->941 940->939 943 7ff75c2dd875-7ff75c2dd87c 941->943 944 7ff75c2dd87e-7ff75c2dd884 941->944 943->940 943->944 946 7ff75c2dd894-7ff75c2dd8a9 call 7ff75c2e417c 944->946 947 7ff75c2dd886-7ff75c2dd88f call 7ff75c2dcba0 944->947 951 7ff75c2dd9c3-7ff75c2dd9cc 946->951 952 7ff75c2dd8af-7ff75c2dd8b8 946->952 947->946 953 7ff75c2dda20-7ff75c2dda45 WriteFile 951->953 954 7ff75c2dd9ce-7ff75c2dd9d4 951->954 952->951 955 7ff75c2dd8be-7ff75c2dd8c2 952->955 960 7ff75c2dda50 953->960 961 7ff75c2dda47-7ff75c2dda4d GetLastError 953->961 956 7ff75c2dd9d6-7ff75c2dd9d9 954->956 957 7ff75c2dda0c-7ff75c2dda1e call 7ff75c2dd298 954->957 958 7ff75c2dd8c4-7ff75c2dd8cc call 7ff75c2d4870 955->958 959 7ff75c2dd8d3-7ff75c2dd8de 955->959 963 7ff75c2dd9db-7ff75c2dd9de 956->963 964 7ff75c2dd9f8-7ff75c2dda0a call 7ff75c2dd4b8 956->964 984 7ff75c2dd9b0-7ff75c2dd9b7 957->984 958->959 966 7ff75c2dd8e0-7ff75c2dd8e9 959->966 967 7ff75c2dd8ef-7ff75c2dd904 GetConsoleMode 959->967 962 7ff75c2dda53 960->962 961->960 969 7ff75c2dda58 962->969 970 7ff75c2dda64-7ff75c2dda6e 963->970 971 7ff75c2dd9e4-7ff75c2dd9f6 call 7ff75c2dd39c 963->971 964->984 966->951 966->967 974 7ff75c2dd9bc 967->974 975 7ff75c2dd90a-7ff75c2dd910 967->975 977 7ff75c2dda5d 969->977 978 7ff75c2dda70-7ff75c2dda75 970->978 979 7ff75c2ddacc-7ff75c2ddad1 970->979 971->984 974->951 982 7ff75c2dd916-7ff75c2dd919 975->982 983 7ff75c2dd999-7ff75c2dd9ab call 7ff75c2dce20 975->983 977->970 985 7ff75c2ddaa3-7ff75c2ddaad 978->985 986 7ff75c2dda77-7ff75c2dda7a 978->986 979->939 988 7ff75c2dd924-7ff75c2dd932 982->988 989 7ff75c2dd91b-7ff75c2dd91e 982->989 983->984 984->969 995 7ff75c2ddab4-7ff75c2ddac3 985->995 996 7ff75c2ddaaf-7ff75c2ddab2 985->996 993 7ff75c2dda93-7ff75c2dda9e call 7ff75c2d7c04 986->993 994 7ff75c2dda7c-7ff75c2dda8b 986->994 991 7ff75c2dd934 988->991 992 7ff75c2dd990-7ff75c2dd994 988->992 989->977 989->988 997 7ff75c2dd938-7ff75c2dd94f call 7ff75c2e4248 991->997 992->962 993->985 994->993 995->979 996->937 996->995 1002 7ff75c2dd951-7ff75c2dd95d 997->1002 1003 7ff75c2dd987-7ff75c2dd98d GetLastError 997->1003 1004 7ff75c2dd95f-7ff75c2dd971 call 7ff75c2e4248 1002->1004 1005 7ff75c2dd97c-7ff75c2dd983 1002->1005 1003->992 1004->1003 1009 7ff75c2dd973-7ff75c2dd97a 1004->1009 1005->992 1007 7ff75c2dd985 1005->1007 1007->997 1009->1005
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF75C2DD7CB), ref: 00007FF75C2DD8FC
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF75C2DD7CB), ref: 00007FF75C2DD987
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 953036326-0
                                                                                                                                                                                                                            • Opcode ID: bc0851f0a6fd351bd2c279fe1f2b83c40d0216da9fe35e8edc63442de1074daf
                                                                                                                                                                                                                            • Instruction ID: 1986fc3a314aa7bf66b4010ac7e80c66cb108abe23f05622587c369bdbd4c29f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bc0851f0a6fd351bd2c279fe1f2b83c40d0216da9fe35e8edc63442de1074daf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F191B6B3E08A5185F791EF7594403BDABA0AB64B88F984139DE4E56788DE3CD443C730

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 1010 7ff75c2dfedc-7ff75c2dff18 1011 7ff75c2e00ce-7ff75c2e00d9 call 7ff75c2d7c48 1010->1011 1012 7ff75c2dff1e-7ff75c2dff27 1010->1012 1018 7ff75c2e00dd-7ff75c2e00f9 call 7ff75c2cb190 1011->1018 1012->1011 1013 7ff75c2dff2d-7ff75c2dff36 1012->1013 1013->1011 1015 7ff75c2dff3c-7ff75c2dff3f 1013->1015 1015->1011 1017 7ff75c2dff45-7ff75c2dff56 1015->1017 1019 7ff75c2dff80-7ff75c2dff84 1017->1019 1020 7ff75c2dff58-7ff75c2dff61 call 7ff75c2dfe80 1017->1020 1019->1011 1024 7ff75c2dff8a-7ff75c2dff8e 1019->1024 1020->1011 1028 7ff75c2dff67-7ff75c2dff6a 1020->1028 1024->1011 1025 7ff75c2dff94-7ff75c2dff98 1024->1025 1025->1011 1027 7ff75c2dff9e-7ff75c2dffae call 7ff75c2dfe80 1025->1027 1033 7ff75c2dffb0-7ff75c2dffb3 1027->1033 1034 7ff75c2dffb7 call 7ff75c2e6af4 1027->1034 1028->1011 1030 7ff75c2dff70-7ff75c2dff73 1028->1030 1030->1011 1032 7ff75c2dff79 1030->1032 1032->1019 1033->1034 1035 7ff75c2dffb5 1033->1035 1037 7ff75c2dffbc-7ff75c2dffd3 call 7ff75c2e5ef8 1034->1037 1035->1034 1040 7ff75c2e00fa-7ff75c2e010f call 7ff75c2db184 1037->1040 1041 7ff75c2dffd9-7ff75c2dffe4 call 7ff75c2e5f28 1037->1041 1041->1040 1046 7ff75c2dffea-7ff75c2dfff5 call 7ff75c2e5f58 1041->1046 1046->1040 1049 7ff75c2dfffb-7ff75c2e008f 1046->1049 1050 7ff75c2e0091-7ff75c2e00ad 1049->1050 1051 7ff75c2e00c9-7ff75c2e00cc 1049->1051 1052 7ff75c2e00c4-7ff75c2e00c7 1050->1052 1053 7ff75c2e00af-7ff75c2e00b3 1050->1053 1051->1018 1052->1018 1053->1052 1054 7ff75c2e00b5-7ff75c2e00c0 call 7ff75c2e6b38 1053->1054 1054->1052
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4170891091-0
                                                                                                                                                                                                                            • Opcode ID: 370ce9d4f2c7d76b293318dbc6090e4c5bee4dbd118fb82c4348fa72ec4c37d0
                                                                                                                                                                                                                            • Instruction ID: 3ebceb44e2fdb00c2f1046552834ef29f1db733024ff534f32287e33f2aa959b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 370ce9d4f2c7d76b293318dbc6090e4c5bee4dbd118fb82c4348fa72ec4c37d0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1951E473F052124BEB14EB34D9817BCA6A1AB14358F980239EE1E63BD9DF38A447C611
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2780335769-0
                                                                                                                                                                                                                            • Opcode ID: d95bba4d8d6dfe48708944133a46dd7653105ad03b271015d470148417994f60
                                                                                                                                                                                                                            • Instruction ID: 4d7f49bac212c52ca09940b343d8faae7dbf5a1d0cc1c25a4656e8cd2bcdaec8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d95bba4d8d6dfe48708944133a46dd7653105ad03b271015d470148417994f60
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 05519163E087418AFB50EF70D4503BDA3A1EB64B58F988439DE095B78CDFB8D5428760
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279662727-0
                                                                                                                                                                                                                            • Opcode ID: 22c7c8ea93c6e55cd6304c5d27c7b8c20ea285c7b5b8d17ce3e3754178751948
                                                                                                                                                                                                                            • Instruction ID: c8aaccfc0d1e1101a9f1f81ee66953885da595fe8e9a985fd9f540b0f7f6c54d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 22c7c8ea93c6e55cd6304c5d27c7b8c20ea285c7b5b8d17ce3e3754178751948
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B341A363D1878283E790AB3095503B9A260FFA4764F549339E69C03BD9DFBCA5E18760
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3058843127-0
                                                                                                                                                                                                                            • Opcode ID: 7cbc3ccfbc8636d3bb4ea780b1106156ddb9104c1ea8e27ac65454a1d4f029ca
                                                                                                                                                                                                                            • Instruction ID: d52df65b268d69cdc70c1daa8e8c74912d5e5a4b50d11eac58afdc7032ec6874
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7cbc3ccfbc8636d3bb4ea780b1106156ddb9104c1ea8e27ac65454a1d4f029ca
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61315B23E0C243A2FA54BB34D4523B99391AF55784FDC4038EA4E873D7DEACA809C671
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1703294689-0
                                                                                                                                                                                                                            • Opcode ID: d42b1d15f89cff999c412ea6ed71aaaa637f6e35a99c016800735a1d81ea02f1
                                                                                                                                                                                                                            • Instruction ID: e649d2786444a932491b850cf17164b8e46cbd23f2e94181ef5292d429445847
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d42b1d15f89cff999c412ea6ed71aaaa637f6e35a99c016800735a1d81ea02f1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A9D09E13B0970682FB557B725C9D67C92215F59711F9C143CC84F5639BCD6DA84E4328
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 9984e4d9f7a55e09bc11c7d35f089592e1d844af62e83f1c9a7169eb0bd1663a
                                                                                                                                                                                                                            • Instruction ID: 4f7b53ef782d53980258745a580c6765b2a845cb83346af91de3f60dde501e12
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9984e4d9f7a55e09bc11c7d35f089592e1d844af62e83f1c9a7169eb0bd1663a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F051F527B0D242A6FA68BA76940077AE291BF44BA4F8C8731DD6D477D9CF3CE4018620
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileHandleType
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3000768030-0
                                                                                                                                                                                                                            • Opcode ID: 89c3bb33dcc8d8fb84e538812bfc243b46b619b3f5bfaaaab49fc6713e7ed776
                                                                                                                                                                                                                            • Instruction ID: 427a88338ae255b5fcde9a9485046f6aab0fe0665be2e696fc0cede631de6963
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89c3bb33dcc8d8fb84e538812bfc243b46b619b3f5bfaaaab49fc6713e7ed776
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0331A627A18B5581E7A09F348980278AB50FB56BB0FAC0339DB6E473E4DF38E452D354
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF75C2DB259,?,?,00000000,00007FF75C2DB30E), ref: 00007FF75C2DB44A
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF75C2DB259,?,?,00000000,00007FF75C2DB30E), ref: 00007FF75C2DB454
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1687624791-0
                                                                                                                                                                                                                            • Opcode ID: 9b2d7134de24883dfe1bed83b750e6d11ab913f1325c24bc3ad054c6785d1330
                                                                                                                                                                                                                            • Instruction ID: ad0b3c1e7fea11908ff28d5f251d9ffd0785998ba7a91f4fd62cc85b3e5642bb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9b2d7134de24883dfe1bed83b750e6d11ab913f1325c24bc3ad054c6785d1330
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E921C623F0868241FFD0B775946437D92819FA47A4F8C4239DA2DC77DADEECA4868311
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF75C2DC9A0,?,?,?,?,00007FF75C2C1023,00007FF75C2DCAA9), ref: 00007FF75C2DCA00
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,?,?,00007FF75C2DC9A0,?,?,?,?,00007FF75C2C1023,00007FF75C2DCAA9), ref: 00007FF75C2DCA0A
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2976181284-0
                                                                                                                                                                                                                            • Opcode ID: 126ad919738aaa719abfbc17f8cc0c41deb71979501f9dc1ba73a397eb3649da
                                                                                                                                                                                                                            • Instruction ID: aa63ff5092dd4a64940dfc29ef21eba860780cc4d3756f196303de3a33d35384
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 126ad919738aaa719abfbc17f8cc0c41deb71979501f9dc1ba73a397eb3649da
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 70110163608B8181EA50EB39A400279A361AB50BF4F980335EEBE4B7E9CE7CD0428740
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2D5AD9), ref: 00007FF75C2D5BF7
                                                                                                                                                                                                                            • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2D5AD9), ref: 00007FF75C2D5C0D
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1707611234-0
                                                                                                                                                                                                                            • Opcode ID: 5b1745944c8e1f0208f906cdcb64eb36400219f32dfaba174e5aece3a08df2ec
                                                                                                                                                                                                                            • Instruction ID: bab1a0ec4883694e45e059fab3edb73a5ffceece276a1d37dfc2fb4ca8141e73
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5b1745944c8e1f0208f906cdcb64eb36400219f32dfaba174e5aece3a08df2ec
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E511947360C74682EB64AB24A40123EF760EB84771F94023EF69D85AD8EFACD055DB20
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1E2
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1EC
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 588628887-0
                                                                                                                                                                                                                            • Opcode ID: 0e60ec9bcbeaef1bc6e8c9d3a4a5a79c6aef9ce5968bebdcadd0a596a0a29cab
                                                                                                                                                                                                                            • Instruction ID: 6b01f7b6960c73c7f1002ee251378c261bbde3e25cf779f838a3d98e2dbe482f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0e60ec9bcbeaef1bc6e8c9d3a4a5a79c6aef9ce5968bebdcadd0a596a0a29cab
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DCE08C13F0820242FF997BB2989923892A04FA4B41FCC0038C80EA636ADE7C68864370
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 377330604-0
                                                                                                                                                                                                                            • Opcode ID: cf01615f97efe34a086462c80a9cc6781e111c0a2437e4ded728319ce65b2c78
                                                                                                                                                                                                                            • Instruction ID: fd99e6b91c83e43b903c9a9ae669a394b20bc0e982dab4f385a36dc0a8c11a8d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cf01615f97efe34a086462c80a9cc6781e111c0a2437e4ded728319ce65b2c78
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3BD01213F1C50381E695377A1C0533990906F64730FE80638C419E27D4DDACE48E4171
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DeleteErrorFileLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2018770650-0
                                                                                                                                                                                                                            • Opcode ID: 67604593d98026fdc8848f919e48d1c3d34ef258b7d123369eb86f310e7cac90
                                                                                                                                                                                                                            • Instruction ID: 0a8728dd0d66a7f3def553ba4d18581883b707b9c1a33fcc9a47d3dd6e5d70bf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67604593d98026fdc8848f919e48d1c3d34ef258b7d123369eb86f310e7cac90
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 06D01213F1D50381E69577B51C5537DD1A02F64734FDC0639C459D23D4DD9CA08B4176
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2772937645-0
                                                                                                                                                                                                                            • Opcode ID: af99be2f07f2496aa3316734a2c6b8900cd6e6c5e1a7ca73bb10cee4439b99b0
                                                                                                                                                                                                                            • Instruction ID: 761568b133a9ef39729eaf2f6f5036f4990cc9ad9dceeb3b85aa165164ef7766
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: af99be2f07f2496aa3316734a2c6b8900cd6e6c5e1a7ca73bb10cee4439b99b0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4B719E53E18AC581E611DB2CD5453FDA360F7A9B4CF98E321DB9C12696EF28E2D9C310
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: e6a1a6245d13ac9f392e831fc71363616ea603e6fd74d20c900946fba1b20a08
                                                                                                                                                                                                                            • Instruction ID: e572a8303ff4322e6d9eaa3731c3140386845a332b5160b815964408990fb078
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e6a1a6245d13ac9f392e831fc71363616ea603e6fd74d20c900946fba1b20a08
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3241D43391824187FAA4AB39E540779B3A5EB66B50F980135DA8E837D9CF2CE443C761
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 840049012-0
                                                                                                                                                                                                                            • Opcode ID: 7a6a9953cb27000a8e432e82601514793e8c9596b1829e06e9d3b57bb966bb43
                                                                                                                                                                                                                            • Instruction ID: 4edd7c86057e72f8fbaff58d53fc263d472b6aa608f386f285665ce466c9b419
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7a6a9953cb27000a8e432e82601514793e8c9596b1829e06e9d3b57bb966bb43
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6217423B09652A5FE54BA32A9047BAE661BF45FD4FCC4431EE0D07786DE7CE145C620
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: d50056e13121e088fd956b9fa59aa1edf025f204b261fbd69ab4f9f5d265a547
                                                                                                                                                                                                                            • Instruction ID: 097a78b0df6379105f8531cbe1d9a41e25e2b6f9d48d7435f7ba2ca81e6ff560
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d50056e13121e088fd956b9fa59aa1edf025f204b261fbd69ab4f9f5d265a547
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2431BE23A1861285F7917BB5984037DA7A0AB60F64FCA4135E91E033DACE7CE4438371
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3947729631-0
                                                                                                                                                                                                                            • Opcode ID: fd6f95c3572bf754f8497049759945b2e7c0237f0ec2a3ff2fce099309aa049a
                                                                                                                                                                                                                            • Instruction ID: 1843e1f3e498318c21ddb142b556ca1fbd1c392d9d1a02deaacb86d695a4b4aa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fd6f95c3572bf754f8497049759945b2e7c0237f0ec2a3ff2fce099309aa049a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5F218D33A08646CAEBA4AFB4D4447BC73A0EB14718F8C5639D61D06BC9DF39D546C750
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 230eb0b453f50547337b140c98883f6bc8fad4d25c6c65a93efb138b352d5fb0
                                                                                                                                                                                                                            • Instruction ID: 7e4203d4e6157a73195de14ac664c82bec7cf3afa3d96255cd2106ded0e7a9b0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 230eb0b453f50547337b140c98883f6bc8fad4d25c6c65a93efb138b352d5fb0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B7114523A1C651C1EAA1BF61941037DE264AF65B84F8C8835FA4C5779ECF7CD4024B60
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 1765455d41bca3f2b959ba3621f16cf0597a8683876aeae35adaef8a4375950f
                                                                                                                                                                                                                            • Instruction ID: 62c48b3f6005f8bc6713f5712f43ff1d6d90feddd85352326b05b7ae1fa99597
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1765455d41bca3f2b959ba3621f16cf0597a8683876aeae35adaef8a4375950f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2E21A733618A8687DB61AF38D440779B6A0EB94B54F9C8238E65D477D9DF3CD8018B10
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: cd44b4cff77b60623d985737580ed1813df099190acaa202378a92fd92a14a74
                                                                                                                                                                                                                            • Instruction ID: a741a869f374b248ef1c6a6161cdaa8f7965a334a4234d157d4da9210bebab8b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cd44b4cff77b60623d985737580ed1813df099190acaa202378a92fd92a14a74
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E601C467A0878241EA44FB76A800269E691BF95FE0F8D8231EE5C53BDACF3CE4024310
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF75C2DBC66,?,?,?,00007FF75C2DAE27,?,?,00000000,00007FF75C2DB0C2), ref: 00007FF75C2DF485
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocateHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279760036-0
                                                                                                                                                                                                                            • Opcode ID: 89b1110bf6de89d28fe3272bd006b9300fe142e42d1b683599a8f3a890580cc9
                                                                                                                                                                                                                            • Instruction ID: 23e4a9c3e167607295daf97428e2597378135a31283b8141d08216d377175ef6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 89b1110bf6de89d28fe3272bd006b9300fe142e42d1b683599a8f3a890580cc9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B3F06D4BB0D24681FED9767294513B992902FA8B91FCC5438CE0E963CAED9CE582423C
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlAllocateHeap.NTDLL(?,?,?,00007FF75C2D0224,?,?,?,00007FF75C2D1736,?,?,?,?,?,00007FF75C2D379D), ref: 00007FF75C2DDEBA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocateHeap
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1279760036-0
                                                                                                                                                                                                                            • Opcode ID: a59a3281ffe6c4ebb895ab54eba730b3e58e72ac8a9ed321292ae6a6c92afa7f
                                                                                                                                                                                                                            • Instruction ID: 6a281da08b16d8ddd728ebc45bf48c474b016fceb1b2d4af1db3cdd6869385a7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a59a3281ffe6c4ebb895ab54eba730b3e58e72ac8a9ed321292ae6a6c92afa7f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 41F0FE93B0964745FED57671585177592904F74B60F8C1B34D92E953C9DE1CA4428231
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 377330604-0
                                                                                                                                                                                                                            • Opcode ID: efba51577d7d247f34b5ea2189c2751f02970dbe8886bcdeefbb3fc7ea22f1a6
                                                                                                                                                                                                                            • Instruction ID: f37e9b900046382b2b60247e6897787d76273c19bb987396d7e42507cd356955
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: efba51577d7d247f34b5ea2189c2751f02970dbe8886bcdeefbb3fc7ea22f1a6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2D41A717D1C6C591E611AB3895013FCA370FBA5B44F98A232DB8D52793EF28A2DCC720
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                            • API String ID: 190572456-2208601799
                                                                                                                                                                                                                            • Opcode ID: b1a607239f8517a729b3d652d22cd5db79448a9b5e9ee3baec4123bb94c2d34d
                                                                                                                                                                                                                            • Instruction ID: 7fe1ed8e8381d7f010a666058e0158005b4ca00b95aaed9a886464d89d9c0b3a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b1a607239f8517a729b3d652d22cd5db79448a9b5e9ee3baec4123bb94c2d34d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A3E19766A0EB03A1FA16EB38F854374A3A5AF04791FCC9539C81D16364EFBCB5498334
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                            • API String ID: 808467561-2761157908
                                                                                                                                                                                                                            • Opcode ID: 0ac7459cf321a8ef47be099bad60f89892d96c011185168162fa84bd7f1c75a5
                                                                                                                                                                                                                            • Instruction ID: cf47318034c301a47bb05b96bd135d6882aa0d0ae5a9095bba01181f863f319b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ac7459cf321a8ef47be099bad60f89892d96c011185168162fa84bd7f1c75a5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 48B2D373A282928BE765DE78D4407FDB7A1FB54748F88513DDA0D67B88DB38A900CB50
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(WideCharToMultiByte,00007FF75C2C20A4,?,?,00000000,00007FF75C2C7A52), ref: 00007FF75C2C77E7
                                                                                                                                                                                                                            • FormatMessageW.KERNEL32 ref: 00007FF75C2C7816
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32 ref: 00007FF75C2C786C
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C2070: GetLastError.KERNEL32(?,?,00000000,00007FF75C2C7A52,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C2097
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                                                                                                                                                                            • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                            • API String ID: 2383786077-2573406579
                                                                                                                                                                                                                            • Opcode ID: 7c57e2b6ebb6fcdc26cf68156021833fc54c556c30b231cb159875f8ec6ec51b
                                                                                                                                                                                                                            • Instruction ID: a052b563af1b54f206b1a1cf64649509f59492d96870e7cd90a3c9062935314e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7c57e2b6ebb6fcdc26cf68156021833fc54c556c30b231cb159875f8ec6ec51b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6E215072A18A4391FB60BB35E854379A3A5BF48784FC84139D64D967A4EF7CE105C720
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3140674995-0
                                                                                                                                                                                                                            • Opcode ID: 5292a8a5a971cd825b96bdf4279ba62df65a4148ba3cf04c0a3a98a1218dcbbd
                                                                                                                                                                                                                            • Instruction ID: 62252fc06b1b4861e420389fde8b9943b2d97c2f1deec8081447d9d5a3fc3ada
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5292a8a5a971cd825b96bdf4279ba62df65a4148ba3cf04c0a3a98a1218dcbbd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DC315273609A8195EB609F74E8807FD7364FB44744F884039DA4D97B98DF78D548C714
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1239891234-0
                                                                                                                                                                                                                            • Opcode ID: 7350904de150d1cb4172e17eeb8809c0d9adbb64f65e259fb5dcc6004eced91a
                                                                                                                                                                                                                            • Instruction ID: bd429441ce531b07af9dbb9b4ec4a5e566797211c46cdd3751eca9b6b419359d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7350904de150d1cb4172e17eeb8809c0d9adbb64f65e259fb5dcc6004eced91a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AF315133618B8195EB609B35E8407AEB3A4FB88754F980139EA8D47B58DF78D54AC710
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2227656907-0
                                                                                                                                                                                                                            • Opcode ID: f5f139a55f972c05e0c5d89b196deaf72ef60d6fd941209caf0256bee93f9f9c
                                                                                                                                                                                                                            • Instruction ID: f4042c87c0d5dcb988dc64dbf6866212f3e6f2f08b5f1c23828a2c1b5dc2549b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f5f139a55f972c05e0c5d89b196deaf72ef60d6fd941209caf0256bee93f9f9c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0CB1F423B1868641EB64EB3598103B9E350EF54BD4F885139EE5E67BC9DE7CE441CB20
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2933794660-0
                                                                                                                                                                                                                            • Opcode ID: 9d2e1f26a6c13150d8e348e866a4e60fab7d691edde13c5122d0fb5ddf5e2557
                                                                                                                                                                                                                            • Instruction ID: 83cc0f0a2b763c0e1d963f6711f50bc8da14432aca43301212561531398e3ef3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9d2e1f26a6c13150d8e348e866a4e60fab7d691edde13c5122d0fb5ddf5e2557
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2118F22B14B0589FB00DB70E8453B873A4FB19728F881E35DA2D867A4DF7CD1588350
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy_s
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1502251526-0
                                                                                                                                                                                                                            • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                            • Instruction ID: 2d6f900f4afc0de8a6c855768104f98ac97fb194e9ef2eeccd1597f42ded0c58
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9CC1E473B186C587E724DF6AA44477AB791F794B84F888239DB4A53B44DB3DE801CB40
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 15204871-0
                                                                                                                                                                                                                            • Opcode ID: 8bf28472abbb38f302bdd9054145850910408531ccd8739ca5623faf81ed61a5
                                                                                                                                                                                                                            • Instruction ID: c398dcfa73dd24c34707c7857ec347ce99c02d67a50e4ba25b5cdd989a93aaa9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8bf28472abbb38f302bdd9054145850910408531ccd8739ca5623faf81ed61a5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D7B16A73A04B89CBEB15CF39C88636CBBA0F784B48F598925DA9D937A4CB39D451C710
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: $
                                                                                                                                                                                                                            • API String ID: 0-227171996
                                                                                                                                                                                                                            • Opcode ID: 62680b4214c8e38aa67099e54eaee54cd4a51e05929bb98f174f9f5e7fccdbd5
                                                                                                                                                                                                                            • Instruction ID: 64e8016d9445b6cd48e686c0de6d46a4c2a777ebd8905c1ffbfbac68401f3875
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 62680b4214c8e38aa67099e54eaee54cd4a51e05929bb98f174f9f5e7fccdbd5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B8E19337A0864685EBA8AE35D050239A3B0FF65B48F9C6135DA4E47798DF39E843C760
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: e+000$gfff
                                                                                                                                                                                                                            • API String ID: 0-3030954782
                                                                                                                                                                                                                            • Opcode ID: d9402999ec3b4142728a727388e47b1752f934331841cfffe43aa77c616a604c
                                                                                                                                                                                                                            • Instruction ID: 8e2d7ae11beefe236d71eee01ff7eab74e6dd5fef1f267ad1c99d54aecfe9b43
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d9402999ec3b4142728a727388e47b1752f934331841cfffe43aa77c616a604c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E4516723B186C586E7A0DE359800769FB91E754B94F8C8231CBAC87BD9CF7DD4468710
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1010374628-0
                                                                                                                                                                                                                            • Opcode ID: 20a8de6129fcc4358b5051699b3e73cb6e4ecf3bbfefe15213e74cd848d0ad84
                                                                                                                                                                                                                            • Instruction ID: 2ac5ffa69cc3e658b122d8f7cae1a74b6c372248b5047079e44e09145bdb1b83
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 20a8de6129fcc4358b5051699b3e73cb6e4ecf3bbfefe15213e74cd848d0ad84
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5C02AF23B0D65740FA95BB36A810779E690AF41B90FCC4639DD6E6A3D7DE7CE4028360
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: gfffffff
                                                                                                                                                                                                                            • API String ID: 0-1523873471
                                                                                                                                                                                                                            • Opcode ID: aa59da8dc29817a34bb06e0156279287f0ef0e83ad0ffa10da33b17da2a914ba
                                                                                                                                                                                                                            • Instruction ID: 5b9f9275f9d651d7eb8eb8fe1853a1ff598e646625bda99caec79a75d8ba44f6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa59da8dc29817a34bb06e0156279287f0ef0e83ad0ffa10da33b17da2a914ba
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 10A14763B087C586EBA1DF39A4507ADB790AB60BC4F888131DE9D47789EE3DD802C711
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: TMP
                                                                                                                                                                                                                            • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                            • Opcode ID: 1131d6759e4130f2925d66fd19f9f4c8e9e47338722a4320035e9764df6ca817
                                                                                                                                                                                                                            • Instruction ID: df458fb37907e39ca05268755499f7a977c2489976cc9a068d40b43c3b2c068f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1131d6759e4130f2925d66fd19f9f4c8e9e47338722a4320035e9764df6ca817
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AA519F57F0974241FAA4BA37591177AD2906F65BC4FCC4074DE0D87B9AEE3CE44382A0
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: HeapProcess
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 54951025-0
                                                                                                                                                                                                                            • Opcode ID: 195131f70009f451d714851774378fc5cf144655c9075022ea441e032830a765
                                                                                                                                                                                                                            • Instruction ID: 976c06d04c7cbb8b0729bf593b24cdeed9b103d300dc3a46c3bc1d8a2a938743
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 195131f70009f451d714851774378fc5cf144655c9075022ea441e032830a765
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6B09222E0BB06C2EB4D3B21ACC272463A86F48B00FDC003CC00CA0320DE2C20E95721
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 988da2ff9976f7a3a2f212018b3c9f62c65de0a9ddacf398a8be25897abdd3c0
                                                                                                                                                                                                                            • Instruction ID: 8590ef4e3b9e8df91e979b2388814de45c094c106be376b9b1ae7b25d78d58d3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 988da2ff9976f7a3a2f212018b3c9f62c65de0a9ddacf398a8be25897abdd3c0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5DE1B133A0864286E7E5AA38C15437CA7B1EB65B54F9CA235CA4D067DDCF2DE843C760
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: dc739ba217e8d7525e0dbb4221bb1156ffd27f7a844179c917fd145e5d596cee
                                                                                                                                                                                                                            • Instruction ID: c493afdc8315c14bf7a0bf273176631dcbfbd4b4c9955e78b2f900ae7ffdf584
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc739ba217e8d7525e0dbb4221bb1156ffd27f7a844179c917fd145e5d596cee
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 50D1B467A0864245F7A8EE39C45037DA7B0EB65B58F986235CE4D477D8CF39D842C360
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 2a5a03d4f2d37f26a4a83bb39de8bbc1b02be890aa9fc7e8ab42557061f02651
                                                                                                                                                                                                                            • Instruction ID: e6c295c0234294caec828be4b6ab9f227349b0b8f09e71318c41300ea3d8a90b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2a5a03d4f2d37f26a4a83bb39de8bbc1b02be890aa9fc7e8ab42557061f02651
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E3C191732145E04BD689EB29E85947A77E2F7C8349FD8803BEB8747785CA3CA414DB20
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 6aa7bf99787ec5a7de91dad91091c5d35b1169658329bb814a37c7e414c2fe94
                                                                                                                                                                                                                            • Instruction ID: 3647a92fbeed830cb15502befa27ec224397dbefe7836ba33650fd71877cc110
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6aa7bf99787ec5a7de91dad91091c5d35b1169658329bb814a37c7e414c2fe94
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6B1AD7391879185E7A8AF39C05073CBBA0EB69B48F9C4135DA4E4739DCF29D842CB60
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: c1e5a5a12fc16a2326922fe28bbde3d0d2aaf4738583f4d920f2d5c0902ac8cf
                                                                                                                                                                                                                            • Instruction ID: 427f4ba8ac2ca31d8341e02fd8ec6cf095ec688129b9198237ee63efda492560
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c1e5a5a12fc16a2326922fe28bbde3d0d2aaf4738583f4d920f2d5c0902ac8cf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5EB1707390878585E7A5DF39C05437CBBA0E769B48FA84136CA4E47399CF39D882DB24
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 81da592c7efc765f809681846dc1b9a79a79fb730cea6e73ee55abedb7db9f85
                                                                                                                                                                                                                            • Instruction ID: 5e8c3ae687f5a4a461995326e78de95def7cec465c9ca23d3a63e930e97e0d91
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 81da592c7efc765f809681846dc1b9a79a79fb730cea6e73ee55abedb7db9f85
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E481E573A0C78186E7B4EB29944037AB691FBA9794F984235DA9D43B8DCF3DD4418B10
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3215553584-0
                                                                                                                                                                                                                            • Opcode ID: 0c6be3828583c1251b2dff01a426288bbc0df4c032204cacdd935bc71b1bcc6d
                                                                                                                                                                                                                            • Instruction ID: ac697330890b13e512bd3a54d3a37483c116f3f06cf88056db368dcab4073d92
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c6be3828583c1251b2dff01a426288bbc0df4c032204cacdd935bc71b1bcc6d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3A610123E1839286FB64AA3CD450339E6A1AF51B70F9C423DEB1D967C5DE7DE8018720
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 52d838da3d42bcc0729659c283a28cd92a27643e0c2f41312aedf76c5b45ce9f
                                                                                                                                                                                                                            • Instruction ID: 8e8367e86e729664adb51e813674cb743eeac796e92443ad3bea0f51ccae6542
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 52d838da3d42bcc0729659c283a28cd92a27643e0c2f41312aedf76c5b45ce9f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 66519977A1865185E7A49B3AC04033973A0EB65B69F7C4131CE4D57BA8CF3AE843D750
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 33814709598d911674ef14d515c4e290207c37ed7ca5c78048858d7b1145f47e
                                                                                                                                                                                                                            • Instruction ID: 9013e18802559699a4197b7c0e4f43bfddda73269d2904e3dab383be57f81a4a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 33814709598d911674ef14d515c4e290207c37ed7ca5c78048858d7b1145f47e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 69517937A1865181F7A4DB3AD044378B3A1EB65B78F6C5131CA4D57B98CB3AE883C750
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 2356839c266074e44d6c3b32b0d390e130724844f38460b0c91198147a8e36cc
                                                                                                                                                                                                                            • Instruction ID: f81524a5162cc7a0fdc42989d614816c950c97bb87488fedd5b41929a8ca4db1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2356839c266074e44d6c3b32b0d390e130724844f38460b0c91198147a8e36cc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F3519777A2865181E7A49B3AD04033873A0EB64B79F685131CE4E57F98CB7AE843C750
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 6502e7c7bba74d8bab5436a6780e6abd603d16a5d672e06cc22bf040a0f78882
                                                                                                                                                                                                                            • Instruction ID: f480b9a6fee18f2760e0395585e9d82abcc6041257f3410b39264d11668d29c5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6502e7c7bba74d8bab5436a6780e6abd603d16a5d672e06cc22bf040a0f78882
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8516237A1869286E7A49F39C040338B7A0EB64B58FE84131DA4D177ADCF3AE853C751
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: c22a5e1ac00a1fbebb85a2155caafdefc8baf266ac9d978e23d0ec8a695ab9a3
                                                                                                                                                                                                                            • Instruction ID: 106787baf26aad8febc5f63fe87f1e622de3bc306b6271d4f36a667f360b5492
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c22a5e1ac00a1fbebb85a2155caafdefc8baf266ac9d978e23d0ec8a695ab9a3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9C518737A1865185E7A49B3AC05033867A1EB64B68FAC4131DE4D17BACCF3AE853C790
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 32d6dc745b4d57639c843eb6388f013956d34b805f5851d643768e498227f15f
                                                                                                                                                                                                                            • Instruction ID: 032402e62f20dd362b06d02c2b52471eb766560641a10840a10b93aa628b9b70
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 32d6dc745b4d57639c843eb6388f013956d34b805f5851d643768e498227f15f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: AE518637A1866186E7A49B3AC04432CA7B1EB65B68F6C4131CE4D57B9CCB3AE853C750
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                                                                                            • Instruction ID: 8a6c20d8526f8332cad7e4d0dcd1aacd258e4dcef3af5a7f46371877d3adca11
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5441A563C4D64A04E9D5993C49087F8A680AF72BA0DDCDAB4DE9A137CFED0D6587C120
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 588628887-0
                                                                                                                                                                                                                            • Opcode ID: 94e2411fe6a44cdc5012a6895df85f14e76dc445c465ef2c2de02e9e3c0424cf
                                                                                                                                                                                                                            • Instruction ID: f085a5979cdbc86d44d56741b520f8a56d884f8974199e827bc730d8a81599de
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 94e2411fe6a44cdc5012a6895df85f14e76dc445c465ef2c2de02e9e3c0424cf
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC41F563B14A5982FF44DF3AD914669A3A1BB48FD0B8CA036DE0D97B58DE3CC5838350
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: e58efc7a4840026da8c2ee224b25c6e4052394f130e4aebb15c57cb528e7ae9d
                                                                                                                                                                                                                            • Instruction ID: e2e6ca9e75fb17d2a872f600f57f6e8d53189c0675695df62091bb2fa47480c6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e58efc7a4840026da8c2ee224b25c6e4052394f130e4aebb15c57cb528e7ae9d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FE31B133B08B4246E7A4AB35645033EE695AF95B90F984238EA8D63BD9DF3CD0038754
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 1fb11526f0929feff4cc1f422dba12fb12f2c28f8ba1b321171814a7f24c0614
                                                                                                                                                                                                                            • Instruction ID: f914c705ea1916514a15f433ba6a356ad672ecbdcc6aeb9f964ef8465e71c21e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1fb11526f0929feff4cc1f422dba12fb12f2c28f8ba1b321171814a7f24c0614
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C6F044737182558AEB959F39E412B2977D0F748380B84817DE58983F04DA3C90508F14
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
                                                                                                                                                                                                                            • Instruction ID: 8319151d8ea8702c1610edb8e91deb8c5710de4bc65796f39713347f487cdcc2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2FA00223D0DD0BE4E744AB64E858230A334FB54710BC8043AD00DE53A09FBCA504C365
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc
                                                                                                                                                                                                                            • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                            • API String ID: 190572456-4266016200
                                                                                                                                                                                                                            • Opcode ID: 3cdbd3228bcaf959503b86dc7f57490f257e6b424ca5642a8cbbc9134cad9dd6
                                                                                                                                                                                                                            • Instruction ID: e51c187c24b5b1452b2dab44f6f22837ce3b12c1a5770b976021e0a43ce45f35
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3cdbd3228bcaf959503b86dc7f57490f257e6b424ca5642a8cbbc9134cad9dd6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5812EB6690EB0390FA16FB74E854375B3A5AF44780BDC2439D81E66364EFBCB5588334
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32 ref: 00007FF75C2C7E2C
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C2070: GetLastError.KERNEL32(?,?,00000000,00007FF75C2C7A52,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C2097
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                            • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                                                                                                                                                                            • API String ID: 203985260-1562484376
                                                                                                                                                                                                                            • Opcode ID: 5f038aab294c8fd19a923c01861dc675f16c94493efdf241cf7f408caab26175
                                                                                                                                                                                                                            • Instruction ID: 2527bd7a1d771b31b41882a54dc428268b7aaff0bd16858795d2435aa5c8f8ac
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5f038aab294c8fd19a923c01861dc675f16c94493efdf241cf7f408caab26175
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 55416163A0CB4391E710BB36A84027AE3A1AF94BD0FD84539E95E57BA5DF3CE501C724
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _fread_nolock
                                                                                                                                                                                                                            • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 840049012-2316137593
                                                                                                                                                                                                                            • Opcode ID: dabfeb4ec98c3ccb982af86128230bda04491cbf112d9b21522f7d62e286295d
                                                                                                                                                                                                                            • Instruction ID: 5c15433712e91e159c6a7113370aa186e9a3c293424369c01b604ac5083cf86f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dabfeb4ec98c3ccb982af86128230bda04491cbf112d9b21522f7d62e286295d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2951A463B0868365FA20B732A8517FAA354EF447C4FC85035EE5D87B95EEBCE5458310
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: -$:$f$p$p
                                                                                                                                                                                                                            • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                            • Opcode ID: 200fc6eded9d23d85e23f8288f3e7e64d2d75ea1ebf8e7eab3da15fbea06ec83
                                                                                                                                                                                                                            • Instruction ID: 08c27ff7cc6350ca3ffab5d5d0fcf3ce392dce7c08b2d358a46168152ff6be59
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 200fc6eded9d23d85e23f8288f3e7e64d2d75ea1ebf8e7eab3da15fbea06ec83
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 07129163A0C24386FBA07A24E1547BAF261EB60B54FCC8535DA89477CCDF3DE4829760
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: f$f$p$p$f
                                                                                                                                                                                                                            • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                            • Opcode ID: 5150cc2f17f8123f8b3830771489176596fdb62c48b2c84a137625a88c910901
                                                                                                                                                                                                                            • Instruction ID: 2e0f82a089eded5c7ab12717f7faf1833841b8c421f087ec25856ce9ecfccd0a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5150cc2f17f8123f8b3830771489176596fdb62c48b2c84a137625a88c910901
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9F127333E0C24385FBA4AA25E0547B9F651EB60754FDC4036E699467ECDB7CE482CB22
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                            • API String ID: 0-3659356012
                                                                                                                                                                                                                            • Opcode ID: 1d55c871d429d0487258d3373e2758673bccc880cefc08fa2b1b2ab31cc24b80
                                                                                                                                                                                                                            • Instruction ID: 40e5670d78f3dbaed1186697a04622ee15c91869777cfb4325c349d123bc9859
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d55c871d429d0487258d3373e2758673bccc880cefc08fa2b1b2ab31cc24b80
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA315C23B08682A6EA24BB23A8417BAE360EF147D4FDC5032DE4D57B55EE7CE5458720
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                            • String ID: csm$csm$csm
                                                                                                                                                                                                                            • API String ID: 849930591-393685449
                                                                                                                                                                                                                            • Opcode ID: 1d9cba0ee705458a84b9eb7887f8bd16089d36748883092d9b0ee740c596672d
                                                                                                                                                                                                                            • Instruction ID: fd6dc0a23857c9bb1188297a0e5f0921cf2e5877192ba7d00bae1a9230f42992
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d9cba0ee705458a84b9eb7887f8bd16089d36748883092d9b0ee740c596672d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8AE19E33A08B819AEB20AB75D4413ADB7A0FB45B88F980135EE8D57B95CF3CE481C751
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C79A7
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C79FE
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide
                                                                                                                                                                                                                            • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                            • API String ID: 626452242-27947307
                                                                                                                                                                                                                            • Opcode ID: b858524ce6855f304c8efe565ccb1bc8f57016cef4207499ca899fb6c0c33817
                                                                                                                                                                                                                            • Instruction ID: f196de1c8168f451f80a1daa40423336957fdba04e52dd586c99afe1366b0db9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b858524ce6855f304c8efe565ccb1bc8f57016cef4207499ca899fb6c0c33817
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 64415E33608B82C2D760EF25A84027AF6A1FB94B90F985139DE8D87BA4DF7CD5558710
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00007FF75C2C30F5), ref: 00007FF75C2C8101
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C2070: GetLastError.KERNEL32(?,?,00000000,00007FF75C2C7A52,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C2097
                                                                                                                                                                                                                            • WideCharToMultiByte.KERNEL32(00000000,00007FF75C2C30F5), ref: 00007FF75C2C8175
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                            • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                            • API String ID: 1717984340-27947307
                                                                                                                                                                                                                            • Opcode ID: 671ff269c8b490ce50744ff8f5587712a6cf4c5d2a9d3efd05795890c2378c30
                                                                                                                                                                                                                            • Instruction ID: eb99a48c667f2d5aa50509976321b5cd56e0c8ff7e106b7e6db373c70e225066
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 671ff269c8b490ce50744ff8f5587712a6cf4c5d2a9d3efd05795890c2378c30
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F2216062B08B4395E710EF3AE840279B7A1BB44BD0F988539DA5D47BA4EF7CE505C710
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo$_fread_nolock
                                                                                                                                                                                                                            • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                                                                                                                                                                            • API String ID: 3231891352-3501660386
                                                                                                                                                                                                                            • Opcode ID: 955cb72806cc26752b80482a522dfb9b6aefbecf1e27963f4e097aa57267746f
                                                                                                                                                                                                                            • Instruction ID: bd71a452ca6f6d58429b0c33437d4c4a9080c871fb5dae1387256d92ada17cd7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 955cb72806cc26752b80482a522dfb9b6aefbecf1e27963f4e097aa57267746f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 61519063A0D64365FA50BB3599413F9E2A19F84B80FCC9135EE4D877DAEE6CE5058330
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C7FB0: MultiByteToWideChar.KERNEL32 ref: 00007FF75C2C7FEA
                                                                                                                                                                                                                            • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF75C2C6BA1,00000000,00000000,00000000,00000000,?,00007FF75C2C154F), ref: 00007FF75C2C667F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF75C2C6693
                                                                                                                                                                                                                            • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF75C2C66DA
                                                                                                                                                                                                                            • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF75C2C6656
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                                                                                            • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                            • API String ID: 2001182103-3498232454
                                                                                                                                                                                                                            • Opcode ID: 512057d8f16e869ec8b02829afa4c0683f2e94174ff51fe4728a8ab148420767
                                                                                                                                                                                                                            • Instruction ID: 9bf9bad3fe089672d5e736c00cc588f85f30fa5911da9041adfb7955de046b39
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 512057d8f16e869ec8b02829afa4c0683f2e94174ff51fe4728a8ab148420767
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E231CA53F1C782A0FA61B731E9553BAD291AF987C0FCC4435DA4D4779AEE2CE1088624
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF75C2CD52A,?,?,?,00007FF75C2CD21C,?,?,00000001,00007FF75C2CCE39), ref: 00007FF75C2CD2FD
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF75C2CD52A,?,?,?,00007FF75C2CD21C,?,?,00000001,00007FF75C2CCE39), ref: 00007FF75C2CD30B
                                                                                                                                                                                                                            • LoadLibraryExW.KERNEL32(?,?,?,00007FF75C2CD52A,?,?,?,00007FF75C2CD21C,?,?,00000001,00007FF75C2CCE39), ref: 00007FF75C2CD335
                                                                                                                                                                                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF75C2CD52A,?,?,?,00007FF75C2CD21C,?,?,00000001,00007FF75C2CCE39), ref: 00007FF75C2CD37B
                                                                                                                                                                                                                            • GetProcAddress.KERNEL32(?,?,?,00007FF75C2CD52A,?,?,?,00007FF75C2CD21C,?,?,00000001,00007FF75C2CCE39), ref: 00007FF75C2CD387
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                            • String ID: api-ms-
                                                                                                                                                                                                                            • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                            • Opcode ID: 6bcac2c6d4744f46f93eb3f7cc5fd1049ae5631bf07c3cf9090e0e6883f90947
                                                                                                                                                                                                                            • Instruction ID: 2a598b8fa1b0e5b45884cffcf7c3e163efed9062247bb60506615fdcdd3d0cef
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6bcac2c6d4744f46f93eb3f7cc5fd1049ae5631bf07c3cf9090e0e6883f90947
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0031A623B1A642A5EE11BB269801779A394BF44BA4F9E0535DD2D5B380DF3CE445C724
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32 ref: 00007FF75C2C7FEA
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C2070: GetLastError.KERNEL32(?,?,00000000,00007FF75C2C7A52,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C2097
                                                                                                                                                                                                                            • MultiByteToWideChar.KERNEL32 ref: 00007FF75C2C8070
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                            • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                            • API String ID: 1717984340-876015163
                                                                                                                                                                                                                            • Opcode ID: 61f1e1f65f2abf587f9c441370b1f9f094646be22c7fe0b557fd9129533f5ae1
                                                                                                                                                                                                                            • Instruction ID: fde4bd3afb7e484b41b9b87395413c534289c6f3751343d851307ea00ba02aba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 61f1e1f65f2abf587f9c441370b1f9f094646be22c7fe0b557fd9129533f5ae1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 99219427B08A4291EB50EB39F84027AE3A1EF847C4F9C4136DB5C97B69EF2CE5518714
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                            • Opcode ID: f2b34ce6245bf40951a90f27d1366218b7b91d15b1d25e2e49f5ff55d596edee
                                                                                                                                                                                                                            • Instruction ID: 8e79d6f98a3e1a7533be760ac52351bd07909a5c1cfcd885b0ffe4ee4077da0d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f2b34ce6245bf40951a90f27d1366218b7b91d15b1d25e2e49f5ff55d596edee
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 46217C27A0C24241FB997336956133AD1814F657B0FDC4734D83E8ABDEDEBCA8434221
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                            • String ID: CONOUT$
                                                                                                                                                                                                                            • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                            • Opcode ID: 666c3d9e2718fc3e384982b01ad58156f77ff8708d305141843743c738123bff
                                                                                                                                                                                                                            • Instruction ID: cf1575aa7490952322dbadb03de2b11a7f7ee6ca86f55540b8faca1418486727
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 666c3d9e2718fc3e384982b01ad58156f77ff8708d305141843743c738123bff
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F011E922B18A4682E750AB66E854339E2A4FB48FE4F484238DD5D877A4CF7CD4048754
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetLastError.KERNEL32(?,?,?,00007FF75C2D7C51,?,?,?,?,00007FF75C2DF497,?,?,00000000,00007FF75C2DBC66,?,?,?), ref: 00007FF75C2DBB57
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2D7C51,?,?,?,?,00007FF75C2DF497,?,?,00000000,00007FF75C2DBC66,?,?,?), ref: 00007FF75C2DBB8D
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2D7C51,?,?,?,?,00007FF75C2DF497,?,?,00000000,00007FF75C2DBC66,?,?,?), ref: 00007FF75C2DBBBA
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2D7C51,?,?,?,?,00007FF75C2DF497,?,?,00000000,00007FF75C2DBC66,?,?,?), ref: 00007FF75C2DBBCB
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2D7C51,?,?,?,?,00007FF75C2DF497,?,?,00000000,00007FF75C2DBC66,?,?,?), ref: 00007FF75C2DBBDC
                                                                                                                                                                                                                            • SetLastError.KERNEL32(?,?,?,00007FF75C2D7C51,?,?,?,?,00007FF75C2DF497,?,?,00000000,00007FF75C2DBC66,?,?,?), ref: 00007FF75C2DBBF7
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value$ErrorLast
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2506987500-0
                                                                                                                                                                                                                            • Opcode ID: 41c599df291fd3e631747b2aace2e23f0e8f3128d708c3cfb7bb859859b12653
                                                                                                                                                                                                                            • Instruction ID: c43ea6e1f7b513e650377bcd6e354f6d129e8317fb2424832d0c7c4b132c1372
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 41c599df291fd3e631747b2aace2e23f0e8f3128d708c3cfb7bb859859b12653
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1911A127A0C24242FB94B335956173AE1414F657B0FDC4734DC2E867DEDEACA4434621
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                            • String ID: csm$f
                                                                                                                                                                                                                            • API String ID: 2395640692-629598281
                                                                                                                                                                                                                            • Opcode ID: 6874ce62e9edfd12495692b318275d0e8d608d4f333f0d723dc3a41740f6e71d
                                                                                                                                                                                                                            • Instruction ID: 39b8ce04e4cdeae298d1728bb19848cbc87cf355c05c842dced31608a321d84b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6874ce62e9edfd12495692b318275d0e8d608d4f333f0d723dc3a41740f6e71d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6951D237B09612A6DB14EF35E404B69BB95FB44B98FA88134DE0E47748DF38E841C7A0
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                            • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                            • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                            • Opcode ID: 2d8bae9984113d9ee1161ba42f49a1f9fa8607ff1cce463a2ed595953dbf4f55
                                                                                                                                                                                                                            • Instruction ID: a183d24a1005cac8aa44baaa6f377a930f0f290c9a5848f53d3e17bb14d5119d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2d8bae9984113d9ee1161ba42f49a1f9fa8607ff1cce463a2ed595953dbf4f55
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3EF06223A18B0681EA50AB34E4457399360EF997A1FDC0239C96E453E8CF6CE04AC724
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _set_statfp
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1156100317-0
                                                                                                                                                                                                                            • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                                            • Instruction ID: c8bc755f0df64f7c551b8dda40e2aaf8c7860fd2b3d13973e25480006270625d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4A115163E1CA1341FA643178E4663B595806F59374E8C063FEB6E263D7DE3CA88086A4
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • FlsGetValue.KERNEL32(?,?,?,00007FF75C2DAE27,?,?,00000000,00007FF75C2DB0C2,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DBC2F
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2DAE27,?,?,00000000,00007FF75C2DB0C2,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DBC4E
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2DAE27,?,?,00000000,00007FF75C2DB0C2,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DBC76
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2DAE27,?,?,00000000,00007FF75C2DB0C2,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DBC87
                                                                                                                                                                                                                            • FlsSetValue.KERNEL32(?,?,?,00007FF75C2DAE27,?,?,00000000,00007FF75C2DB0C2,?,?,?,?,?,00007FF75C2D2A80), ref: 00007FF75C2DBC98
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                            • Opcode ID: 4d9951ddb930028ea16999cbca66bd4ed784f1640a016819559599eea74df80b
                                                                                                                                                                                                                            • Instruction ID: 49730abead303b400f375542665e7f54caef213855e3224e4bcb66218c898e23
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4d9951ddb930028ea16999cbca66bd4ed784f1640a016819559599eea74df80b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 34119D23E0C20245FB98B336A56137AD1416F647A0FDC4334E83E867DEDE6CE9438265
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Value
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3702945584-0
                                                                                                                                                                                                                            • Opcode ID: 2e04664127e5d8fea5349ed94c02016841b9f7de38eab6539d47ab1646b3bbb1
                                                                                                                                                                                                                            • Instruction ID: ea045ad36e9e234f6940cb46a2917081ef0d1677ee2e3cf58d7102c699fd4aa9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 2e04664127e5d8fea5349ed94c02016841b9f7de38eab6539d47ab1646b3bbb1
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 03110A27A0C20741FB9872369422B7AD1415F65364EEC5734D93D8A7DEDD6CB8434221
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: verbose
                                                                                                                                                                                                                            • API String ID: 3215553584-579935070
                                                                                                                                                                                                                            • Opcode ID: 1903bda87c4ff8796606e8a839c08c655b45d75bc3d73885c4b5b9d3096c4afd
                                                                                                                                                                                                                            • Instruction ID: cfdc885e517aac4d486b6a308bd1eafead217bd19721f69dc8331873c84d663e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1903bda87c4ff8796606e8a839c08c655b45d75bc3d73885c4b5b9d3096c4afd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5691C123A0874681F7A5EA35D4503BDB3A1AB64B54FCC8936DA9D833C9DF3CE4468320
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                            • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                            • Opcode ID: a0eb1a53d3169c6808d927e78ed351066cc1cb27aa5cf4a039fc42470434503a
                                                                                                                                                                                                                            • Instruction ID: 54284fcbd3a7674c6b0676ec205d2fbd22ed28217e360bcc171811d93b66ab7a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a0eb1a53d3169c6808d927e78ed351066cc1cb27aa5cf4a039fc42470434503a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 11816D73E082528AF665AE36915037CB6A0AB11F44FDD803DCA4977395DE3DE903E623
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                            • String ID: MOC$RCC
                                                                                                                                                                                                                            • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                            • Opcode ID: cd0f29946255e309e74fcb50d5115aded8192f9bf5440f1f1eb9698d31b1b80e
                                                                                                                                                                                                                            • Instruction ID: bb86aded45976ba45fdc7802e0c883ea9b9dd0a4c15d23fec75db1fd9c1d221d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cd0f29946255e309e74fcb50d5115aded8192f9bf5440f1f1eb9698d31b1b80e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E9616733A08B859AE720EF75D0803ADBBA0FB44B88F584225EE4D17B99DF38E455C710
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                            • String ID: csm$csm
                                                                                                                                                                                                                            • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                            • Opcode ID: 46c1d6a381f338ebb670c5d7ab3bc16210c8d1d1246f20c28ff8771ada5ef693
                                                                                                                                                                                                                            • Instruction ID: 2a1026926222da846f8594e00befeffbe82d5dd96e7036926ddbf53fcb75e0e5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 46c1d6a381f338ebb670c5d7ab3bc16210c8d1d1246f20c28ff8771ada5ef693
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3051AC339486829AEB74AF359084368B7A0FB55B84F9C8236DA9D47BD9CF3CE450C711
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(?,00007FF75C2C2B0F), ref: 00007FF75C2C30C1
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2C2070: GetLastError.KERNEL32(?,?,00000000,00007FF75C2C7A52,?,?,?,?,?,?,?,?,?,?,?,00007FF75C2C1023), ref: 00007FF75C2C2097
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                            • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                            • API String ID: 2776309574-1977442011
                                                                                                                                                                                                                            • Opcode ID: ffccb051d3bc93b8d7d7749af726f94290e388cae2a19a91baddb17076418f5f
                                                                                                                                                                                                                            • Instruction ID: 9bfb277cbb3e564950db06678e1dec9c9691603c8b6c7184320128bfd78710fa
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffccb051d3bc93b8d7d7749af726f94290e388cae2a19a91baddb17076418f5f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E1017C63B2C642A5FA21B734E8063B59295AF58780FC81436D94EC6392EEACE148C624
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2718003287-0
                                                                                                                                                                                                                            • Opcode ID: 56014f98c4375db7cd9cd138184bf14cd97057d405c5f2c5078312aa4a460ab3
                                                                                                                                                                                                                            • Instruction ID: 78d34f1cbad772837a198d6cd3b28a65c083c92f6a2c3d0feb2d64fabe379825
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 56014f98c4375db7cd9cd138184bf14cd97057d405c5f2c5078312aa4a460ab3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F5D1E173B18A8189E751DFB5C4402AC77B1FB55798F884225CE5E97B9ADE38E407C320
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Process$ConsoleCurrentShowThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 242035731-0
                                                                                                                                                                                                                            • Opcode ID: 93267d1080b3e3cbd8d0a9e25e3b2f5895aa4e347dfed7a264085a69707fb08f
                                                                                                                                                                                                                            • Instruction ID: 47defeff509a7e851137357ee845af48006c0651719747f2ef7b7d4f947998a6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93267d1080b3e3cbd8d0a9e25e3b2f5895aa4e347dfed7a264085a69707fb08f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FCF06523A18747C2EF55AB76A444239A3A1FF88B90F8C1034D95E93754EE7CE189C728
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Window$Process$ConsoleCurrentShowThread
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 242035731-0
                                                                                                                                                                                                                            • Opcode ID: 75a1641a8899898a335428a09803ee58f148ff016589288d2c12425f69f9b710
                                                                                                                                                                                                                            • Instruction ID: 01e90406d8f22d379303597129f3515ac89c9c743be9135f5b28d94ca245348f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 75a1641a8899898a335428a09803ee58f148ff016589288d2c12425f69f9b710
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FCF08C22A18743C2EA54AB32A444338A361AF88B80F8C2034D91E47754DE3CE0988724
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: ?
                                                                                                                                                                                                                            • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                            • Opcode ID: 0a3d9a2c6523c86c030df9a5c19ce2b4966c9e361a44fc0c5c5f14ca4f8216fa
                                                                                                                                                                                                                            • Instruction ID: b2d4ad95f047dab41938c0bc52a236e2b260ab342bf24480638a1126c7b9eec4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0a3d9a2c6523c86c030df9a5c19ce2b4966c9e361a44fc0c5c5f14ca4f8216fa
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A6410523B1868646FB64AB36D41137AE650EB90BA4F98823DEE5C17BD9DE3CD441C710
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _invalid_parameter_noinfo.LIBCMT ref: 00007FF75C2D989A
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB1CC: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1E2
                                                                                                                                                                                                                              • Part of subcall function 00007FF75C2DB1CC: GetLastError.KERNEL32(?,?,?,00007FF75C2E3582,?,?,?,00007FF75C2E35BF,?,?,00000000,00007FF75C2E3A85,?,?,00000000,00007FF75C2E39B7), ref: 00007FF75C2DB1EC
                                                                                                                                                                                                                            • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF75C2CB4B5), ref: 00007FF75C2D98B8
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: C:\Users\user\Desktop\explorer.exe.0.exe
                                                                                                                                                                                                                            • API String ID: 2553983749-2480207886
                                                                                                                                                                                                                            • Opcode ID: ed4c4ddc6ba55ec2504098fa00b89c4721ab4e83171ef93bd49a65225d9fc6d6
                                                                                                                                                                                                                            • Instruction ID: cbcc4a301670c16658411f364726c0450169f285b2b45cbf766257d0ebde831b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ed4c4ddc6ba55ec2504098fa00b89c4721ab4e83171ef93bd49a65225d9fc6d6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 56419333A08B5689EB94FF3594416BCA794EF55B94B984036FA4E43B49DE3CE482C360
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                            • String ID: U
                                                                                                                                                                                                                            • API String ID: 442123175-4171548499
                                                                                                                                                                                                                            • Opcode ID: dc51142747858649a960dd086b9af45c31a5bc692d4dd8b190574bce523d8d27
                                                                                                                                                                                                                            • Instruction ID: 6cb13d20b13f37a9da18d4e7f78280eab698ea5d91cd715f48d8520cd13cd16d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: dc51142747858649a960dd086b9af45c31a5bc692d4dd8b190574bce523d8d27
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4941E563B28A4186EB60EF35E4447B9A760FB98794F884035EE4D87788DF7CD446C720
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentDirectory
                                                                                                                                                                                                                            • String ID: :
                                                                                                                                                                                                                            • API String ID: 1611563598-336475711
                                                                                                                                                                                                                            • Opcode ID: 709e7ec7808cc89d8e8b1f9978ddc0a4e57477efcaec04eb86f4091237b7047a
                                                                                                                                                                                                                            • Instruction ID: e0223b8cd74c5e92a5db028b4badf97366c2ac5514b97d959058e70d47ce95e7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 709e7ec7808cc89d8e8b1f9978ddc0a4e57477efcaec04eb86f4091237b7047a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3F21C363A0C78281EB60AB35D45436EB3A1FB98B44FC94035DA4D43388CFBCE9468765
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                            • String ID: csm
                                                                                                                                                                                                                            • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                            • Opcode ID: 9abbc046261961642e0ae191188f43d439b3f0fbc2742ea280541fdcad3ae0f6
                                                                                                                                                                                                                            • Instruction ID: 3cd86f603b75ad274f08c71698e048510c67b61fd2163ab403adc18367eb9303
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9abbc046261961642e0ae191188f43d439b3f0fbc2742ea280541fdcad3ae0f6
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 09115837618B8192EB219F29E400369B7E4FB88B94F984235EE8C47B68DF3CC5518B00
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000000.00000002.2104605947.00007FF75C2C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF75C2C0000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104579752.00007FF75C2C0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104637064.00007FF75C2EB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C2FE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104667082.00007FF75C300000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000000.00000002.2104719328.00007FF75C302000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_0_2_7ff75c2c0000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                            • String ID: :
                                                                                                                                                                                                                            • API String ID: 2595371189-336475711
                                                                                                                                                                                                                            • Opcode ID: 5fcfa487bc11bb0757f654d2247ae3b306383d0dd0d50167c3aa74d7c7a9fa00
                                                                                                                                                                                                                            • Instruction ID: 269aeef869e947dcb961bb89cabac2f74bfc81ba81fee76f89df06cf0617b2e3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5fcfa487bc11bb0757f654d2247ae3b306383d0dd0d50167c3aa74d7c7a9fa00
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8001DF2391820286F771BF70A46137EA3A0EF94B04FC81039D50C96399DE7CE506DB25

                                                                                                                                                                                                                            Execution Graph

                                                                                                                                                                                                                            Execution Coverage:1.3%
                                                                                                                                                                                                                            Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                            Signature Coverage:0.6%
                                                                                                                                                                                                                            Total number of Nodes:1504
                                                                                                                                                                                                                            Total number of Limit Nodes:15
                                                                                                                                                                                                                            execution_graph 30213 70a0e6f0 30214 70a0e89b 30213->30214 30215 70a0e745 30213->30215 30215->30214 30216 70a0e805 strlen strncmp 30215->30216 30218 70a0e82b 30216->30218 30218->30214 30219 70a0dc10 30218->30219 30246 70a96500 30219->30246 30222 70a0dc92 30227 70a0e550 30222->30227 30241 70a0dca0 30222->30241 30223 70a0dcbe 30248 70a0a420 malloc 30223->30248 30290 70a96730 14 API calls 30227->30290 30228 70a05300 35 API calls 30237 70a0dc56 30228->30237 30229 70a0df7d 30229->30237 30293 70a96730 14 API calls 30229->30293 30230 70a0a420 55 API calls 30230->30237 30234 70a0dce4 30286 70a04590 35 API calls 30234->30286 30237->30228 30237->30229 30237->30230 30245 70a0dc7b 30237->30245 30287 70a05300 35 API calls 30237->30287 30289 70a26c50 __iob_func abort 30237->30289 30291 70a265b0 __iob_func abort 30237->30291 30292 70a27110 __iob_func abort 30237->30292 30240 70a0dcef free 30240->30237 30241->30223 30241->30237 30244 70a0df5a 30241->30244 30241->30245 30242 70a0ddb6 free 30242->30237 30288 70a04590 35 API calls 30244->30288 30245->30214 30247 70a0dc26 strlen strncmp 30246->30247 30247->30222 30247->30237 30249 70a0a4c4 30248->30249 30250 70a0a44a 30248->30250 30252 70a0a5c0 30249->30252 30253 70a0a4db 30249->30253 30294 70a2df40 __iob_func abort 30250->30294 30298 70a04230 7 API calls 30252->30298 30257 70a0a6c0 _errno strerror 30253->30257 30258 70a0a4ea _errno 30253->30258 30255 70a0a455 30264 70a0a490 free 30255->30264 30265 70a0a470 30255->30265 30256 70a0a5d3 30259 70a0a730 fprintf 30256->30259 30260 70a0a5df _errno 30256->30260 30266 70a0a6e6 fprintf 30257->30266 30261 70a0a47a 30258->30261 30274 70a0a767 _errno strerror fprintf 30259->30274 30262 70a0a787 _errno strerror fprintf 30260->30262 30263 70a0a5eb 8 API calls 30260->30263 30261->30234 30261->30245 30272 70a0a660 fprintf 30263->30272 30268 70a0a4f4 30264->30268 30269 70a0a4a9 30264->30269 30295 70a03760 14 API calls 30265->30295 30266->30259 30296 70a04230 7 API calls 30268->30296 30277 70a0a4b8 _errno 30269->30277 30283 70a0a690 30269->30283 30276 70a0a675 fputc 30272->30276 30273 70a0a507 30273->30266 30275 70a0a513 _errno 30273->30275 30274->30262 30275->30274 30279 70a0a51f fprintf 30275->30279 30276->30283 30277->30261 30297 70a2df20 30279->30297 30281 70a0a54a fprintf fputc fclose 30282 70a0a57f 30281->30282 30284 70a0a590 fprintf 30282->30284 30283->30257 30285 70a0a5a5 fputc 30284->30285 30285->30252 30286->30240 30287->30242 30288->30229 30289->30237 30291->30237 30292->30237 30294->30255 30295->30261 30296->30273 30297->30281 30298->30256 30299 70a199f0 30300 70a1a6d0 30299->30300 30311 70a19a11 30299->30311 30301 70a1a6e7 _errno 30300->30301 30339 70a19afb 30300->30339 30301->30311 30302 70a1a903 _errno 30303 70a1a911 fprintf fprintf fputc fclose 30302->30303 30304 70a1aff3 _errno strerror fprintf 30302->30304 30307 70a1a96e fprintf 30303->30307 30304->30339 30305 70a1b33e fprintf 30305->30311 30306 70a1a73f _errno 30308 70a1b493 _errno strerror fprintf 30306->30308 31008 70a1a74b fprintf fputc fclose 30306->31008 30313 70a1a980 fputc 30307->30313 30308->30311 30309 70a1a8be fprintf 30309->30339 30312 70a1a7c0 _errno 30311->30312 30318 70a1b4c8 _errno 30311->30318 30311->30339 30343 70a1bd30 free 30311->30343 30344 70a1b087 _errno 30311->30344 30348 70a1b76f _errno 30311->30348 30352 70a04a00 48 API calls 30311->30352 30371 70a1bd71 _errno 30311->30371 30402 70a1a704 30311->30402 30410 70a1cf97 _errno 30311->30410 30427 70a1b417 _time64 30311->30427 30461 70a1b82f _errno 30311->30461 30605 70a1d91b GetProcAddress 30311->30605 30690 70a1a569 _time64 srand 30311->30690 30723 70a2d860 2 API calls 30311->30723 30815 70a2d470 10 API calls 30311->30815 30900 70a05fd0 107 API calls 30311->30900 30923 70a1b7f0 free 30311->30923 30936 70a1b238 free 30311->30936 30969 70a1b277 _errno 30311->30969 30978 70a0a420 55 API calls 30311->30978 30992 70a1b216 memcpy free 30311->30992 31040 70a2dcd0 30311->31040 31054 70a2da40 30311->31054 31068 70a2d5c0 30311->31068 31082 70a2d710 30311->31082 31096 70a70be0 30311->31096 31105 70a04a00 30311->31105 31230 70a04230 7 API calls 30311->31230 30312->30339 30312->30402 30323 70a1a992 GetProcAddress 30313->30323 30314 70a1a788 fputc 30314->30402 30316 70a19c7e GetProcAddress 30320 70a19cab GetProcAddress 30316->30320 30316->30339 30317 70a1b021 fprintf 30317->30311 30318->30311 30321 70a19cc0 GetProcAddress 30320->30321 30320->30339 30326 70a19cd5 GetProcAddress 30321->30326 30321->30339 30322 70a1ae06 _errno 30328 70a1c753 _errno strerror fprintf 30322->30328 30329 70a1ae14 fprintf fprintf fputc fclose 30322->30329 30330 70a19cf1 GetProcAddress 30323->30330 30323->30339 30326->30323 30326->30330 30327 70a1a7fc _errno 30332 70a1c1f3 _errno strerror fprintf 30327->30332 30333 70a1a808 fprintf fputc fclose 30327->30333 30328->30339 30338 70a1ae78 fprintf 30329->30338 30330->30311 30331 70a19d0d GetProcAddress 30330->30331 30331->30311 30337 70a19d29 GetProcAddress 30331->30337 30332->30339 30347 70a1a85a fputc 30333->30347 30335 70a1bb50 _errno 30335->30339 30342 70a1c801 _errno strerror fprintf 30335->30342 30336 70a1bf77 fprintf 30336->30339 30337->30339 30345 70a19d3e GetProcAddress 30337->30345 30357 70a1ae91 fputc 30338->30357 30339->30302 30339->30305 30339->30306 30339->30309 30339->30311 30339->30312 30339->30316 30339->30317 30339->30322 30339->30327 30339->30335 30339->30336 30340 70a04230 7 API calls 30339->30340 30341 70a1aa9f _errno 30339->30341 30339->30343 30346 70a1ac44 _errno 30339->30346 30351 70a1c1aa fprintf 30339->30351 30356 70a1ad14 _errno 30339->30356 30358 70a1aeb1 fprintf 30339->30358 30359 70a1a9e2 _errno 30339->30359 30360 70a1c781 fprintf 30339->30360 30362 70a1bb71 _errno strerror fprintf 30339->30362 30364 70a1ab74 _errno 30339->30364 30368 70a1c0f8 _errno 30339->30368 30339->30371 30372 70a1c221 fprintf 30339->30372 30373 70a1ba8f fprintf 30339->30373 30374 70a1aeee fprintf 30339->30374 30378 70a1bfae fprintf 30339->30378 30385 70a1c98c fprintf 30339->30385 30386 70a1c5d8 _errno 30339->30386 30387 70a1b98e fprintf 30339->30387 30389 70a1ccfd fprintf 30339->30389 30394 70a1bce1 fprintf 30339->30394 30395 70a1c129 fprintf fprintf fputc fclose 30339->30395 30398 70a1b627 _errno 30339->30398 30401 70a1c855 _errno 30339->30401 30406 70a1b884 _errno 30339->30406 30408 70a1b1cd fprintf 30339->30408 30409 70a1cab3 fprintf 30339->30409 30413 70a1c361 fprintf 30339->30413 30422 70a1bd9e fprintf 30339->30422 30423 70a1c30a fprintf 30339->30423 30425 70a1af56 _errno 30339->30425 30426 70a1bf4a _errno 30339->30426 30429 70a1d181 fprintf 30339->30429 30430 70a1c4e5 fprintf 30339->30430 30433 70a1c178 fprintf 30339->30433 30435 70a1c26f _errno 30339->30435 30440 70a1c7d8 fprintf 30339->30440 30441 70a1b7c6 _errno 30339->30441 30442 70a1bbc7 _errno 30339->30442 30448 70a1c51c fprintf 30339->30448 30449 70a1d1e2 _errno 30339->30449 30451 70a1b5cd fprintf 30339->30451 30454 70a1be70 _errno 30339->30454 30455 70a1c72a fprintf 30339->30455 30456 70a1baf4 _errno 30339->30456 30457 70a1ba0e fprintf fprintf fputc fclose 30339->30457 30459 70a1b17e fprintf fprintf fputc fclose 30339->30459 30460 70a1c00b _errno 30339->30460 30463 70a1c955 fprintf 30339->30463 30467 70a1c9eb _errno 30339->30467 30468 70a1b9f4 _errno 30339->30468 30475 70a1c398 fprintf 30339->30475 30481 70a1d684 fprintf 30339->30481 30487 70a1cb0a fprintf 30339->30487 30490 70a1c3f5 _errno 30339->30490 30491 70a1b44e 30339->30491 30492 70a1c6fa fprintf 30339->30492 30495 70a1c644 _errno 30339->30495 30496 70a1ba5d fprintf 30339->30496 30498 70a1d3a3 fprintf 30339->30498 30499 70a1cb61 fprintf 30339->30499 30505 70a1ccbf fprintf 30339->30505 30508 70a1cd73 _errno 30339->30508 30510 70a1b562 _errno 30339->30510 30514 70a1cf3a fprintf 30339->30514 30515 70a1be04 _errno 30339->30515 30525 70a1d75c _errno 30339->30525 30531 70a1d111 fprintf 30339->30531 30534 70a1d6c2 fprintf 30339->30534 30535 70a1b57e fprintf fprintf fputc fclose 30339->30535 30541 70a1cbc0 _errno 30339->30541 30542 70a1d4d1 fprintf 30339->30542 30548 70a1ce7b _errno 30339->30548 30549 70a1e045 fprintf 30339->30549 30550 70a2196f fprintf 30339->30550 30551 70a1d3da fprintf 30339->30551 30552 70a1d422 _errno 30339->30552 30553 70a1d87a _errno 30339->30553 30559 70a1d2bb _errno 30339->30559 30568 70a1dba2 fprintf 30339->30568 30573 70a1d548 fprintf 30339->30573 30579 70a1d80b fprintf 30339->30579 30582 70a1dd71 GetProcAddress 30339->30582 30588 70a1d5be _errno 30339->30588 30591 70a1dc33 _errno 30339->30591 30592 70a219be _errno 30339->30592 30607 70a21d3b _errno 30339->30607 30608 70a1dcf9 fprintf 30339->30608 30609 70a21a84 fprintf 30339->30609 30614 70a1e132 _errno 30339->30614 30615 70a1df24 _errno 30339->30615 30617 70a1dcc0 fprintf 30339->30617 30620 70a21e01 fprintf 30339->30620 30621 70a21a4b fprintf 30339->30621 30622 70a1d96f _errno 30339->30622 30627 70a21e4d _errno 30339->30627 30628 70a1e1f8 fprintf 30339->30628 30631 70a1da35 fprintf 30339->30631 30632 70a21c10 _errno 30339->30632 30633 70a1dfea fprintf 30339->30633 30635 70a21dc8 fprintf 30339->30635 30640 70a1de12 _errno 30339->30640 30641 70a21afe _errno 30339->30641 30642 70a1da81 _errno 30339->30642 30646 70a1e1bf fprintf 30339->30646 30647 70a21f13 fprintf 30339->30647 30650 70a1d9fc fprintf 30339->30650 30653 70a1ded8 fprintf 30339->30653 30656 70a1dfb1 fprintf 30339->30656 30657 70a21cd6 fprintf 30339->30657 30658 70a2182e _errno 30339->30658 30661 70a21bc4 fprintf 30339->30661 30662 70a2171c _errno 30339->30662 30663 70a1db47 fprintf 30339->30663 30668 70a21eda fprintf 30339->30668 30669 70a1de9f fprintf 30339->30669 30674 70a21c9d fprintf 30339->30674 30675 70a218f4 fprintf 30339->30675 30677 70a215dc _errno 30339->30677 30678 70a21b8b fprintf 30339->30678 30679 70a1db0e fprintf 30339->30679 30680 70a217e2 fprintf 30339->30680 30682 70a214ca _errno 30339->30682 30687 70a216a2 fprintf 30339->30687 30689 70a2138a _errno 30339->30689 30691 70a218bb fprintf 30339->30691 30696 70a21278 _errno 30339->30696 30697 70a217a9 fprintf 30339->30697 30703 70a21590 fprintf 30339->30703 30707 70a21450 fprintf 30339->30707 30709 70a1b716 _errno 30339->30709 30710 70a21138 _errno 30339->30710 30711 70a21669 fprintf 30339->30711 30713 70a2133e fprintf 30339->30713 30715 70a21026 _errno 30339->30715 30716 70a21557 fprintf 30339->30716 30720 70a211fe fprintf 30339->30720 30721 70a20ee6 _errno 30339->30721 30722 70a21417 fprintf 30339->30722 30728 70a20dd4 _errno 30339->30728 30729 70a21305 fprintf 30339->30729 30734 70a210ec fprintf 30339->30734 30738 70a20fac fprintf 30339->30738 30740 70a20c94 _errno 30339->30740 30741 70a211c5 fprintf 30339->30741 30743 70a20e9a fprintf 30339->30743 30745 70a20b82 _errno 30339->30745 30747 70a210b3 fprintf 30339->30747 30750 70a20d5a fprintf 30339->30750 30751 70a20a42 _errno 30339->30751 30752 70a20f73 fprintf 30339->30752 30757 70a20930 _errno 30339->30757 30758 70a20e61 fprintf 30339->30758 30763 70a20c48 fprintf 30339->30763 30766 70a1b164 _errno 30339->30766 30768 70a20b08 fprintf 30339->30768 30771 70a207f0 _errno 30339->30771 30772 70a20d21 fprintf 30339->30772 30775 70a209f6 fprintf 30339->30775 30776 70a206de _errno 30339->30776 30777 70a20c0f fprintf 30339->30777 30781 70a208b6 fprintf 30339->30781 30782 70a2059e _errno 30339->30782 30783 70a20acf fprintf 30339->30783 30788 70a2048c _errno 30339->30788 30789 70a209bd fprintf 30339->30789 30792 70a1b309 _errno 30339->30792 30795 70a207a4 fprintf 30339->30795 30799 70a20664 fprintf 30339->30799 30801 70a2034c _errno 30339->30801 30802 70a2087d fprintf 30339->30802 30804 70a20552 fprintf 30339->30804 30805 70a2023a _errno 30339->30805 30806 70a2076b fprintf 30339->30806 30810 70a20412 fprintf 30339->30810 30811 70a200fa _errno 30339->30811 30812 70a2062b fprintf 30339->30812 30818 70a1ffe8 _errno 30339->30818 30819 70a20519 fprintf 30339->30819 30820 70a1c59b _errno 30339->30820 30824 70a20300 fprintf 30339->30824 30829 70a201c0 fprintf 30339->30829 30831 70a1fea8 _errno 30339->30831 30832 70a203d9 fprintf 30339->30832 30834 70a200ae fprintf 30339->30834 30835 70a1b956 _errno 30339->30835 30836 70a1fd96 _errno 30339->30836 30838 70a202c7 fprintf 30339->30838 30842 70a1d0c1 fprintf 30339->30842 30843 70a1ff6e fprintf 30339->30843 30845 70a1fc56 _errno 30339->30845 30846 70a20187 fprintf 30339->30846 30851 70a1fb44 _errno 30339->30851 30852 70a20075 fprintf 30339->30852 30856 70a1fe5c fprintf 30339->30856 30861 70a1fd1c fprintf 30339->30861 30863 70a1fa04 _errno 30339->30863 30865 70a1ff35 fprintf 30339->30865 30867 70a1fc0a fprintf 30339->30867 30868 70a1f8f2 _errno 30339->30868 30869 70a1fe23 fprintf 30339->30869 30873 70a1faca fprintf 30339->30873 30874 70a1f7b2 _errno 30339->30874 30875 70a1fce3 fprintf 30339->30875 30880 70a1f6a0 _errno 30339->30880 30881 70a1fbd1 fprintf 30339->30881 30885 70a1f9b8 fprintf 30339->30885 30891 70a1f878 fprintf 30339->30891 30892 70a1f560 _errno 30339->30892 30893 70a1fa91 fprintf 30339->30893 30897 70a1f766 fprintf 30339->30897 30898 70a1f44e _errno 30339->30898 30899 70a1f97f fprintf 30339->30899 30904 70a1f626 fprintf 30339->30904 30905 70a1f30e _errno 30339->30905 30906 70a1f83f fprintf 30339->30906 30911 70a1f1fc _errno 30339->30911 30912 70a1f72d fprintf 30339->30912 30916 70a1f514 fprintf 30339->30916 30921 70a1f3d4 fprintf 30339->30921 30922 70a1f0bc _errno 30339->30922 30924 70a1f5ed fprintf 30339->30924 30927 70a1f2c2 fprintf 30339->30927 30928 70a1efaa _errno 30339->30928 30929 70a1f4db fprintf 30339->30929 30932 70a1f182 fprintf 30339->30932 30934 70a1ee6a _errno 30339->30934 30935 70a1f39b fprintf 30339->30935 30942 70a1ed58 _errno 30339->30942 30943 70a1f289 fprintf 30339->30943 30947 70a1f070 fprintf 30339->30947 30953 70a1ef30 fprintf 30339->30953 30954 70a1ec18 _errno 30339->30954 30955 70a1f149 fprintf 30339->30955 30959 70a1ee1e fprintf 30339->30959 30960 70a1eb06 _errno 30339->30960 30961 70a1f037 fprintf 30339->30961 30964 70a1ecde fprintf 30339->30964 30967 70a1e9c6 _errno 30339->30967 30968 70a1eef7 fprintf 30339->30968 30975 70a1ede5 fprintf 30339->30975 30981 70a1ebcc fprintf 30339->30981 30982 70a1e8b4 _errno 30339->30982 30986 70a1ea8c fprintf 30339->30986 30988 70a1eca5 fprintf 30339->30988 30994 70a1eb93 fprintf 30339->30994 30995 70a1e758 _errno 30339->30995 30996 70a1e97a fprintf 30339->30996 30997 70a1ea53 fprintf 30339->30997 30998 70a1e646 _errno 30339->30998 31003 70a1e81e fprintf 30339->31003 31004 70a1e4ce _errno 30339->31004 31010 70a1e3bc _errno 30339->31010 31011 70a1e941 fprintf 30339->31011 31015 70a1e70c fprintf 30339->31015 31018 70a1e594 fprintf 30339->31018 31019 70a1e7e5 fprintf 30339->31019 31020 70a1e482 fprintf 30339->31020 31022 70a1e6d3 fprintf 30339->31022 31023 70a1e244 _errno 30339->31023 31024 70a1e55b fprintf 30339->31024 31028 70a1e449 fprintf 30339->31028 31030 70a1e30a fprintf 30339->31030 31033 70a1e2d1 fprintf 30339->31033 30340->30339 30349 70a1bc80 _errno strerror fprintf 30341->30349 30350 70a1aaad fprintf fprintf fputc fclose 30341->30350 30342->30311 30343->30311 30343->30339 30391 70a1b0a4 30344->30391 30344->30402 30345->30311 30353 70a19d5a GetProcAddress 30345->30353 30354 70a1ac50 fprintf fprintf fputc fclose 30346->30354 30355 70a1bf0b _errno strerror fprintf 30346->30355 30347->30311 30348->30311 30361 70a1c333 _errno strerror fprintf 30348->30361 30367 70a1bca0 fprintf 30349->30367 30377 70a1ab11 fprintf 30350->30377 30370 70a1c1d3 _errno strerror fprintf 30351->30370 30363 70a1b3cc free 30352->30363 30353->30311 30365 70a19d6f GetProcAddress GetProcAddress 30353->30365 30383 70a1acb4 fprintf 30354->30383 30355->30339 30369 70a1ad20 fprintf fprintf fputc fclose 30356->30369 30356->30370 30357->30312 30358->30339 30375 70a1cf6a _errno strerror fprintf 30359->30375 30376 70a1a9ee fprintf fprintf fputc fclose 30359->30376 30388 70a1c7aa _errno strerror fprintf 30360->30388 30361->30339 30362->30311 31207 70a0da10 30363->31207 30380 70a1ab80 fprintf fprintf fputc fclose 30364->30380 30381 70a1c4b7 _errno strerror fprintf 30364->30381 30365->30311 30382 70a19d98 GetProcAddress GetProcAddress 30365->30382 30367->30314 30368->30339 30384 70a1c100 _errno strerror fprintf 30368->30384 30396 70a1ad84 fprintf 30369->30396 30370->30332 30371->30339 30372->30339 30373->30311 30374->30311 30375->30311 30399 70a1aa52 fprintf 30376->30399 30400 70a1ab2a fputc 30377->30400 30378->30339 30403 70a1abe4 fprintf 30380->30403 30381->30339 30382->30339 30390 70a19dc1 GetProcAddress GetProcAddress 30382->30390 30407 70a1accd fputc 30383->30407 30384->30339 30385->30311 30386->30339 30397 70a1c5e2 _errno strerror fprintf 30386->30397 30387->30311 30388->30339 30416 70a1cd26 _errno strerror fprintf 30389->30416 30390->30339 30404 70a19df1 GetProcAddress 30390->30404 30392 70a1b0c3 _errno 30391->30392 30420 70a1b4fe fprintf 30391->30420 31227 70a04230 7 API calls 30391->31227 30392->30362 30405 70a1b0d1 fprintf fputc fclose 30392->30405 30394->30311 30395->30339 30421 70a1ad9d fputc 30396->30421 30397->30339 30411 70a1b631 _errno strerror fprintf 30398->30411 30412 70a1b64c fprintf fprintf fputc fclose 30398->30412 30424 70a1aa6b fputc 30399->30424 30400->30311 30414 70a1c877 fprintf fprintf fputc fclose 30401->30414 30415 70a1c85c _errno strerror fprintf 30401->30415 30428 70a1abfd fputc 30403->30428 30404->30339 30417 70a19e0d GetProcAddress 30404->30417 30432 70a1b11d fputc 30405->30432 30418 70a1b890 fprintf fprintf fputc fclose 30406->30418 30419 70a1cadc _errno strerror fprintf 30406->30419 30407->30312 30434 70a1b1df fputc 30408->30434 30409->30339 30410->30402 30469 70a1cfdd 30410->30469 30411->30412 30436 70a1b6b0 fprintf 30412->30436 30413->30339 30445 70a1c8db fprintf 30414->30445 30415->30414 30416->30311 30417->30339 30431 70a19e29 GetProcAddress 30417->30431 30450 70a1b8f4 fprintf 30418->30450 30419->30339 30420->30311 30421->30312 30422->30311 30423->30361 30424->30312 30437 70a1cc91 _errno strerror fprintf 30425->30437 30438 70a1af64 fprintf fprintf fputc fclose 30425->30438 30426->30339 30439 70a1cb33 _errno strerror fprintf 30426->30439 31229 70a098a0 19 API calls 30427->31229 30428->30312 30429->30311 30430->30339 30431->30311 30447 70a19e3e GetProcAddress 30431->30447 30432->30402 30466 70a1c18a fputc 30433->30466 30434->30311 30435->30416 30452 70a1c27b fprintf fprintf fputc fclose 30435->30452 30470 70a1b6c9 fputc 30436->30470 30437->30339 30474 70a1afc8 fprintf 30438->30474 30439->30339 30440->30342 30441->30339 30458 70a1ca85 _errno strerror fprintf 30441->30458 30443 70a1bbd1 _errno strerror fprintf 30442->30443 30444 70a1bbec fprintf fprintf fputc fclose 30442->30444 30443->30444 30476 70a1bc50 fprintf 30444->30476 30479 70a1c8f4 fputc 30445->30479 30447->30311 30462 70a19e53 GetProcAddress 30447->30462 30448->30339 30464 70a21921 _errno strerror fprintf 30449->30464 30465 70a1d1f4 fprintf fprintf fputc fclose 30449->30465 30482 70a1b90d fputc 30450->30482 30486 70a1b5df fputc 30451->30486 30488 70a1c2d8 fprintf 30452->30488 30471 70a1d13a _errno strerror fprintf 30454->30471 30472 70a1be7c fprintf fprintf fputc fclose 30454->30472 30455->30328 30456->30339 30473 70a1bb03 _errno strerror fprintf 30456->30473 30457->30339 30458->30339 30459->30339 30477 70a1c035 fprintf fprintf fputc fclose 30460->30477 30478 70a1c01a _errno strerror fprintf 30460->30478 30461->30311 30462->30339 30480 70a19e6f GetProcAddress 30462->30480 30463->30339 30497 70a21941 _errno strerror fprintf 30464->30497 30494 70a1d251 fprintf 30465->30494 30466->30311 30483 70a1c9f6 fprintf fprintf fputc fclose 30467->30483 30484 70a1d83b _errno strerror fprintf 30467->30484 30468->30339 30485 70a1ce25 _errno strerror fprintf 30468->30485 31231 70a04230 7 API calls 30469->31231 30470->30312 30471->30339 30501 70a1bee0 fprintf 30472->30501 30473->30339 30502 70a1afe1 fputc 30474->30502 30475->30339 30506 70a1bc69 fputc 30476->30506 30507 70a1c099 fprintf 30477->30507 30478->30477 30479->30312 30480->30311 30493 70a19e84 GetProcAddress 30480->30493 30481->30339 30482->30312 30511 70a1ca5a fprintf 30483->30511 30484->30339 30485->30311 30486->30318 30487->30439 30516 70a1c2ea fputc 30488->30516 30503 70a1d375 _errno strerror fprintf 30490->30503 30504 70a1c408 fprintf fprintf fputc fclose 30490->30504 30491->30402 30492->30339 30493->30339 30509 70a19ea0 GetProcAddress 30493->30509 30523 70a1d263 fputc 30494->30523 30512 70a1d4fa _errno strerror fprintf 30495->30512 30513 70a1c64f fprintf fprintf fputc fclose 30495->30513 30527 70a1ba6f fputc 30496->30527 30497->30339 30498->30339 30499->30339 30500 70a1cff0 30517 70a1cffc _errno 30500->30517 30518 70a1d07f fprintf 30500->30518 30530 70a1bef9 fputc 30501->30530 30502->30312 30503->30339 30519 70a1c46c fprintf 30504->30519 30505->30339 30506->30312 30532 70a1c0b2 fputc 30507->30532 30520 70a1cd81 _errno strerror fprintf 30508->30520 30521 70a1cd9c fprintf fprintf fputc fclose 30508->30521 30509->30339 30522 70a19eb5 GetProcAddress 30509->30522 30510->30339 30524 70a1c906 _errno strerror fprintf 30510->30524 30536 70a1ca73 fputc 30511->30536 30544 70a1d51a _errno strerror fprintf 30512->30544 30539 70a1c6b3 fprintf 30513->30539 30514->30375 30515->30339 30526 70a1be0e _errno strerror fprintf 30515->30526 30516->30339 30528 70a1d021 fprintf fputc fclose 30517->30528 30529 70a1d006 _errno strerror fprintf 30517->30529 30540 70a1d061 fputc 30518->30540 30545 70a1c485 fputc 30519->30545 30520->30521 30546 70a1cdfc fprintf 30521->30546 30522->30311 30533 70a19ed1 GetProcAddress 30522->30533 30523->30339 30524->30339 30537 70a1e017 _errno strerror fprintf 30525->30537 30538 70a1d76e fprintf fprintf fputc fclose 30525->30538 30526->30339 30527->30311 30528->30540 30529->30528 30530->30312 30531->30471 30532->30312 30533->30339 30547 70a19eed GetProcAddress 30533->30547 30534->30311 30535->30339 30536->30312 30537->30339 30560 70a1d7d2 fprintf 30538->30560 30561 70a1c6cc fputc 30539->30561 30540->30402 30554 70a1cbe2 fprintf fprintf fputc fclose 30541->30554 30555 70a1cbc7 _errno strerror fprintf 30541->30555 30542->30512 30544->30339 30545->30312 30566 70a1ce13 fputc 30546->30566 30547->30311 30556 70a19f02 GetProcAddress 30547->30556 30557 70a1ce82 _errno strerror fprintf 30548->30557 30558 70a1ce9d fprintf fprintf fputc fclose 30548->30558 30569 70a1e075 GetProcAddress 30549->30569 30550->30339 30551->30339 30552->30497 30562 70a1d434 fprintf fprintf fputc fclose 30552->30562 30563 70a1db74 _errno strerror fprintf 30553->30563 30564 70a1d88c fprintf fprintf fputc fclose 30553->30564 30572 70a1cc46 fprintf 30554->30572 30555->30554 30556->30339 30567 70a19f1e GetProcAddress 30556->30567 30557->30558 30577 70a1cf01 fprintf 30558->30577 30570 70a1dd26 _errno strerror fprintf 30559->30570 30571 70a1d2cd fprintf fprintf fputc fclose 30559->30571 30578 70a1d7eb fputc 30560->30578 30561->30312 30580 70a1d498 fprintf 30562->30580 30563->30339 30581 70a1d8f0 fprintf 30564->30581 30566->30402 30567->30339 30574 70a19f3a GetProcAddress 30567->30574 30568->30311 30575 70a1e091 GetProcAddress 30569->30575 30576 70a1a4b9 GetProcAddress 30569->30576 30586 70a1dd46 GetProcAddress 30570->30586 30585 70a1d331 fprintf 30571->30585 30587 70a1cc5f fputc 30572->30587 30573->30311 30574->30311 30584 70a19f56 GetProcAddress 30574->30584 30575->30339 30575->30576 30576->30582 30583 70a1a4d5 GetProcAddress 30576->30583 30590 70a1cf1a fputc 30577->30590 30578->30312 30579->30484 30594 70a1d4b1 fputc 30580->30594 30595 70a1d909 fputc 30581->30595 30582->30583 30593 70a1dd8d GetProcAddress 30582->30593 30583->30311 30583->30586 30584->30339 30589 70a19f72 GetProcAddress 30584->30589 30599 70a1d34a fputc 30585->30599 30586->30339 30587->30312 30596 70a1d5e7 fprintf fprintf fputc fclose 30588->30596 30597 70a1d5cc _errno strerror fprintf 30588->30597 30589->30339 30598 70a19f8e GetProcAddress 30589->30598 30590->30312 30600 70a1dc41 _errno strerror fprintf 30591->30600 30601 70a1dc5c fprintf fprintf fputc fclose 30591->30601 30602 70a219e7 fprintf fprintf fputc fclose 30592->30602 30603 70a219cc _errno strerror fprintf 30592->30603 30593->30583 30604 70a1dda9 GetProcAddress 30593->30604 30594->30312 30595->30312 30610 70a1d64b fprintf 30596->30610 30597->30596 30598->30339 30606 70a19faa GetProcAddress 30598->30606 30599->30312 30600->30601 30601->30339 30602->30339 30603->30602 30604->30339 30604->30583 30605->30311 30605->30339 30606->30339 30611 70a19fc6 GetProcAddress 30606->30611 30612 70a21d64 fprintf fprintf fputc fclose 30607->30612 30613 70a21d49 _errno strerror fprintf 30607->30613 30608->30339 30609->30339 30625 70a1d664 fputc 30610->30625 30611->30339 30616 70a19fdb GetProcAddress 30611->30616 30612->30339 30613->30612 30618 70a1e140 _errno strerror fprintf 30614->30618 30619 70a1e15b fprintf fprintf fputc fclose 30614->30619 30623 70a1df32 _errno strerror fprintf 30615->30623 30624 70a1df4d fprintf fprintf fputc fclose 30615->30624 30616->30339 30626 70a19ff7 GetProcAddress 30616->30626 30636 70a1dcd9 fputc 30617->30636 30618->30619 30619->30339 30620->30339 30639 70a21a64 fputc 30621->30639 30629 70a1d998 fprintf fprintf fputc fclose 30622->30629 30630 70a1d97d _errno strerror fprintf 30622->30630 30623->30624 30624->30339 30625->30312 30626->30339 30634 70a1a00c GetProcAddress 30626->30634 30637 70a21e76 fprintf fprintf fputc fclose 30627->30637 30638 70a21e5b _errno strerror fprintf 30627->30638 30628->30339 30629->30339 30630->30629 30631->30339 30643 70a21c39 fprintf fprintf fputc fclose 30632->30643 30644 70a21c1e _errno strerror fprintf 30632->30644 30633->30339 30634->30339 30645 70a1a021 GetProcAddress 30634->30645 30660 70a21de1 fputc 30635->30660 30636->30312 30637->30339 30638->30637 30639->30312 30648 70a1de20 _errno strerror fprintf 30640->30648 30649 70a1de3b fprintf fprintf fputc fclose 30640->30649 30651 70a21b27 fprintf fprintf fputc fclose 30641->30651 30652 70a21b0c _errno strerror fprintf 30641->30652 30654 70a1daaa fprintf fprintf fputc fclose 30642->30654 30655 70a1da8f _errno strerror fprintf 30642->30655 30643->30339 30644->30643 30645->30339 30659 70a1a03d GetProcAddress 30645->30659 30667 70a1e1d8 fputc 30646->30667 30647->30339 30648->30649 30649->30339 30670 70a1da15 fputc 30650->30670 30651->30339 30652->30651 30653->30339 30654->30339 30655->30654 30673 70a1dfca fputc 30656->30673 30657->30339 30664 70a21857 fprintf fprintf fputc fclose 30658->30664 30665 70a2183c _errno strerror fprintf 30658->30665 30659->30339 30666 70a1a059 GetProcAddress 30659->30666 30660->30312 30661->30339 30671 70a21745 fprintf fprintf fputc fclose 30662->30671 30672 70a2172a _errno strerror fprintf 30662->30672 30663->30339 30664->30339 30665->30664 30666->30339 30676 70a1a075 GetProcAddress 30666->30676 30667->30312 30683 70a21ef3 fputc 30668->30683 30686 70a1deb8 fputc 30669->30686 30670->30312 30671->30339 30672->30671 30673->30312 30688 70a21cb6 fputc 30674->30688 30675->30339 30676->30339 30681 70a1a091 GetProcAddress 30676->30681 30684 70a21605 fprintf fprintf fputc fclose 30677->30684 30685 70a215ea _errno strerror fprintf 30677->30685 30695 70a21ba4 fputc 30678->30695 30698 70a1db27 fputc 30679->30698 30680->30339 30681->30339 30692 70a1a0ad GetProcAddress 30681->30692 30693 70a214f3 fprintf fprintf fputc fclose 30682->30693 30694 70a214d8 _errno strerror fprintf 30682->30694 30683->30312 30684->30339 30685->30684 30686->30312 30687->30339 30688->30312 30699 70a213b3 fprintf fprintf fputc fclose 30689->30699 30700 70a21398 _errno strerror fprintf 30689->30700 31035 70a2d860 30690->31035 30706 70a218d4 fputc 30691->30706 30692->30339 30702 70a1a0c9 GetProcAddress 30692->30702 30693->30339 30694->30693 30695->30312 30704 70a212a1 fprintf fprintf fputc fclose 30696->30704 30705 70a21286 _errno strerror fprintf 30696->30705 30712 70a217c2 fputc 30697->30712 30698->30312 30699->30339 30700->30699 30702->30339 30708 70a1a0e5 GetProcAddress 30702->30708 30703->30339 30704->30339 30705->30704 30706->30312 30707->30339 30708->30339 30714 70a1a101 GetProcAddress 30708->30714 30709->30339 30717 70a1b71e _errno strerror fprintf 30709->30717 30718 70a21161 fprintf fprintf fputc fclose 30710->30718 30719 70a21146 _errno strerror fprintf 30710->30719 30727 70a21682 fputc 30711->30727 30712->30312 30713->30339 30714->30339 30724 70a1a116 GetProcAddress 30714->30724 30725 70a21034 _errno strerror fprintf 30715->30725 30726 70a2104f fprintf fprintf fputc fclose 30715->30726 30733 70a21570 fputc 30716->30733 30717->30339 30718->30339 30719->30718 30720->30339 30730 70a20ef4 _errno strerror fprintf 30721->30730 30731 70a20f0f fprintf fprintf fputc fclose 30721->30731 30737 70a21430 fputc 30722->30737 30723->30311 30724->30339 30732 70a1a132 GetProcAddress 30724->30732 30725->30726 30726->30339 30727->30312 30735 70a20de2 _errno strerror fprintf 30728->30735 30736 70a20dfd fprintf fprintf fputc fclose 30728->30736 30742 70a2131e fputc 30729->30742 30730->30731 30731->30339 30732->30339 30739 70a1a14e GetProcAddress 30732->30739 30733->30312 30734->30339 30735->30736 30736->30339 30737->30312 30738->30339 30739->30339 30746 70a1a16a GetProcAddress 30739->30746 30748 70a20ca2 _errno strerror fprintf 30740->30748 30749 70a20cbd fprintf fprintf fputc fclose 30740->30749 30756 70a211de fputc 30741->30756 30742->30312 30743->30339 30753 70a20b90 _errno strerror fprintf 30745->30753 30754 70a20bab fprintf fprintf fputc fclose 30745->30754 30746->30339 30755 70a1a186 GetProcAddress 30746->30755 30762 70a210cc fputc 30747->30762 30748->30749 30749->30339 30750->30339 30759 70a20a50 _errno strerror fprintf 30751->30759 30760 70a20a6b fprintf fprintf fputc fclose 30751->30760 30767 70a20f8c fputc 30752->30767 30753->30754 30754->30339 30755->30339 30761 70a1a1a2 GetProcAddress 30755->30761 30756->30312 30764 70a20959 fprintf fprintf fputc fclose 30757->30764 30765 70a2093e _errno strerror fprintf 30757->30765 30773 70a20e7a fputc 30758->30773 30759->30760 30760->30339 30761->30339 30770 70a1a1be GetProcAddress 30761->30770 30762->30312 30763->30339 30764->30339 30765->30764 30766->30339 30774 70a1c545 _errno strerror fprintf 30766->30774 30767->30312 30768->30339 30770->30339 30778 70a1a1d3 GetProcAddress 30770->30778 30779 70a20819 fprintf fprintf fputc fclose 30771->30779 30780 70a207fe _errno strerror fprintf 30771->30780 30787 70a20d3a fputc 30772->30787 30773->30312 30774->30311 30775->30339 30784 70a20707 fprintf fprintf fputc fclose 30776->30784 30785 70a206ec _errno strerror fprintf 30776->30785 30793 70a20c28 fputc 30777->30793 30778->30339 30786 70a1a1e8 GetProcAddress 30778->30786 30779->30339 30780->30779 30781->30339 30790 70a205c7 fprintf fprintf fputc fclose 30782->30790 30791 70a205ac _errno strerror fprintf 30782->30791 30798 70a20ae8 fputc 30783->30798 30784->30339 30785->30784 30786->30339 30794 70a1a204 GetProcAddress 30786->30794 30787->30312 30796 70a204b5 fprintf fprintf fputc fclose 30788->30796 30797 70a2049a _errno strerror fprintf 30788->30797 30803 70a209d6 fputc 30789->30803 30790->30339 30791->30790 30792->30339 30792->30388 30793->30312 30794->30339 30800 70a1a220 GetProcAddress 30794->30800 30795->30339 30796->30339 30797->30796 30798->30312 30799->30339 30800->30339 30807 70a1a23c GetProcAddress 30800->30807 30808 70a20375 fprintf fprintf fputc fclose 30801->30808 30809 70a2035a _errno strerror fprintf 30801->30809 30817 70a20896 fputc 30802->30817 30803->30312 30804->30339 30813 70a20263 fprintf fprintf fputc fclose 30805->30813 30814 70a20248 _errno strerror fprintf 30805->30814 30823 70a20784 fputc 30806->30823 30807->30339 30816 70a1a258 GetProcAddress 30807->30816 30808->30339 30809->30808 30810->30339 30821 70a20123 fprintf fprintf fputc fclose 30811->30821 30822 70a20108 _errno strerror fprintf 30811->30822 30828 70a20644 fputc 30812->30828 30813->30339 30814->30813 30815->30311 30816->30339 30825 70a1a26d GetProcAddress 30816->30825 30817->30312 30826 70a20011 fprintf fprintf fputc fclose 30818->30826 30827 70a1fff6 _errno strerror fprintf 30818->30827 30833 70a20532 fputc 30819->30833 30820->30339 30820->30544 30821->30339 30822->30821 30823->30312 30824->30339 30825->30339 30830 70a1a289 GetProcAddress 30825->30830 30826->30339 30827->30826 30828->30312 30829->30339 30830->30339 30839 70a1a2a5 GetProcAddress 30830->30839 30840 70a1fed1 fprintf fprintf fputc fclose 30831->30840 30841 70a1feb6 _errno strerror fprintf 30831->30841 30850 70a203f2 fputc 30832->30850 30833->30312 30834->30339 30835->30339 30844 70a1cc71 _errno strerror fprintf 30835->30844 30847 70a1fda4 _errno strerror fprintf 30836->30847 30848 70a1fdbf fprintf fprintf fputc fclose 30836->30848 30855 70a202e0 fputc 30838->30855 30839->30339 30849 70a1a2ba GetProcAddress 30839->30849 30840->30339 30841->30840 30842->30339 30843->30339 30844->30437 30853 70a1fc64 _errno strerror fprintf 30845->30853 30854 70a1fc7f fprintf fprintf fputc fclose 30845->30854 30860 70a201a0 fputc 30846->30860 30847->30848 30848->30339 30849->30339 30857 70a1a2d6 GetProcAddress 30849->30857 30850->30312 30858 70a1fb52 _errno strerror fprintf 30851->30858 30859 70a1fb6d fprintf fprintf fputc fclose 30851->30859 30866 70a2008e fputc 30852->30866 30853->30854 30854->30339 30855->30312 30856->30339 30857->30339 30864 70a1a2f2 GetProcAddress 30857->30864 30858->30859 30859->30339 30860->30312 30861->30339 30870 70a1fa12 _errno strerror fprintf 30863->30870 30871 70a1fa2d fprintf fprintf fputc fclose 30863->30871 30864->30339 30872 70a1a30e GetProcAddress 30864->30872 30879 70a1ff4e fputc 30865->30879 30866->30312 30867->30339 30876 70a1f900 _errno strerror fprintf 30868->30876 30877 70a1f91b fprintf fprintf fputc fclose 30868->30877 30884 70a1fe3c fputc 30869->30884 30870->30871 30871->30339 30872->30339 30878 70a1a32a GetProcAddress 30872->30878 30873->30339 30882 70a1f7c0 _errno strerror fprintf 30874->30882 30883 70a1f7db fprintf fprintf fputc fclose 30874->30883 30890 70a1fcfc fputc 30875->30890 30876->30877 30877->30339 30878->30339 30887 70a1a33f GetProcAddress 30878->30887 30879->30312 30888 70a1f6c9 fprintf fprintf fputc fclose 30880->30888 30889 70a1f6ae _errno strerror fprintf 30880->30889 30896 70a1fbea fputc 30881->30896 30882->30883 30883->30339 30884->30312 30885->30339 30887->30339 30894 70a1a35b GetProcAddress 30887->30894 30888->30339 30889->30888 30890->30312 30891->30339 30901 70a1f589 fprintf fprintf fputc fclose 30892->30901 30902 70a1f56e _errno strerror fprintf 30892->30902 30909 70a1faaa fputc 30893->30909 30894->30339 30895 70a1a377 GetProcAddress 30894->30895 30895->30339 30903 70a1a38c GetProcAddress 30895->30903 30896->30312 30897->30339 30907 70a1f477 fprintf fprintf fputc fclose 30898->30907 30908 70a1f45c _errno strerror fprintf 30898->30908 30915 70a1f998 fputc 30899->30915 30900->30311 30901->30339 30902->30901 30903->30339 30910 70a1a3a8 GetProcAddress 30903->30910 30904->30339 30913 70a1f337 fprintf fprintf fputc fclose 30905->30913 30914 70a1f31c _errno strerror fprintf 30905->30914 30920 70a1f858 fputc 30906->30920 30907->30339 30908->30907 30909->30312 30910->30339 30917 70a1a3c4 GetProcAddress 30910->30917 30918 70a1f225 fprintf fprintf fputc fclose 30911->30918 30919 70a1f20a _errno strerror fprintf 30911->30919 30926 70a1f746 fputc 30912->30926 30913->30339 30914->30913 30915->30312 30916->30339 30917->30339 30925 70a1a3e0 GetProcAddress 30917->30925 30918->30339 30919->30918 30920->30312 30921->30339 30930 70a1f0e5 fprintf fprintf fputc fclose 30922->30930 30931 70a1f0ca _errno strerror fprintf 30922->30931 30923->30311 30923->30339 30939 70a1f606 fputc 30924->30939 30925->30339 30933 70a1a3f5 GetProcAddress 30925->30933 30926->30312 30927->30339 30937 70a1efd3 fprintf fprintf fputc fclose 30928->30937 30938 70a1efb8 _errno strerror fprintf 30928->30938 30946 70a1f4f4 fputc 30929->30946 30930->30339 30931->30930 30932->30339 30940 70a1a411 GetProcAddress 30933->30940 30941 70a1e84b GetProcAddress 30933->30941 30944 70a1ee93 fprintf fprintf fputc fclose 30934->30944 30945 70a1ee78 _errno strerror fprintf 30934->30945 30952 70a1f3b4 fputc 30935->30952 30936->30311 30936->30339 30937->30339 30938->30937 30939->30312 30948 70a1e5f2 GetProcAddress 30940->30948 30949 70a1a42d GetProcAddress 30940->30949 30941->30339 30941->30940 30950 70a1ed81 fprintf fprintf fputc fclose 30942->30950 30951 70a1ed66 _errno strerror fprintf 30942->30951 30958 70a1f2a2 fputc 30943->30958 30944->30339 30945->30944 30946->30312 30947->30339 30948->30339 30948->30949 30956 70a1e5c1 GetProcAddress 30949->30956 30957 70a1a449 GetProcAddress 30949->30957 30950->30339 30951->30950 30952->30312 30953->30339 30962 70a1ec41 fprintf fprintf fputc fclose 30954->30962 30963 70a1ec26 _errno strerror fprintf 30954->30963 30972 70a1f162 fputc 30955->30972 30956->30339 30956->30957 30965 70a1a465 GetProcAddress 30957->30965 30966 70a1e368 GetProcAddress 30957->30966 30958->30312 30959->30339 30970 70a1eb14 _errno strerror fprintf 30960->30970 30971 70a1eb2f fprintf fprintf fputc fclose 30960->30971 30980 70a1f050 fputc 30961->30980 30962->30339 30963->30962 30964->30339 30973 70a1a481 GetProcAddress 30965->30973 30974 70a1e337 GetProcAddress 30965->30974 30966->30339 30966->30965 30976 70a1e9d4 _errno strerror fprintf 30967->30976 30977 70a1e9ef fprintf fprintf fputc fclose 30967->30977 30985 70a1ef10 fputc 30968->30985 30969->30402 30979 70a1b299 30969->30979 30970->30971 30971->30339 30972->30312 30983 70a1e0c2 GetProcAddress 30973->30983 30984 70a1a49d GetProcAddress 30973->30984 30974->30339 30974->30973 30991 70a1edfe fputc 30975->30991 30976->30977 30977->30339 30978->30311 30979->30367 30999 70a1b2b8 _errno 30979->30999 31228 70a04230 7 API calls 30979->31228 30980->30312 30981->30339 30989 70a1e8c2 _errno strerror fprintf 30982->30989 30990 70a1e8dd fprintf fprintf fputc fclose 30982->30990 30983->30984 30993 70a1e0de GetProcAddress 30983->30993 30984->30569 30984->30576 30985->30312 30986->30339 31002 70a1ecbe fputc 30988->31002 30989->30990 30990->30339 30991->30312 30992->30311 30993->30339 30993->30984 31009 70a1ebac fputc 30994->31009 31000 70a1e781 fprintf fprintf fputc fclose 30995->31000 31001 70a1e766 _errno strerror fprintf 30995->31001 30996->30339 31014 70a1ea6c fputc 30997->31014 31005 70a1e654 _errno strerror fprintf 30998->31005 31006 70a1e66f fprintf fprintf fputc fclose 30998->31006 31007 70a1c497 _errno strerror fprintf 30999->31007 30999->31008 31000->30339 31001->31000 31002->30312 31003->30339 31012 70a1e4f7 fprintf fprintf fputc fclose 31004->31012 31013 70a1e4dc _errno strerror fprintf 31004->31013 31005->31006 31006->30339 31007->30381 31008->30314 31009->30312 31016 70a1e3e5 fprintf fprintf fputc fclose 31010->31016 31017 70a1e3ca _errno strerror fprintf 31010->31017 31021 70a1e95a fputc 31011->31021 31012->30339 31013->31012 31014->30312 31015->30339 31016->30339 31017->31016 31018->30339 31027 70a1e7fe fputc 31019->31027 31020->30339 31021->30312 31029 70a1e6ec fputc 31022->31029 31025 70a1e252 _errno strerror fprintf 31023->31025 31026 70a1e26d fprintf fprintf fputc fclose 31023->31026 31031 70a1e574 fputc 31024->31031 31025->31026 31026->30339 31027->30312 31032 70a1e462 fputc 31028->31032 31029->30312 31030->30339 31031->30312 31032->30312 31034 70a1e2ea fputc 31033->31034 31034->30312 31036 70a2da25 31035->31036 31039 70a2d872 31035->31039 31232 70a2d400 __iob_func abort 31036->31232 31039->30311 31041 70a2dce8 31040->31041 31042 70a2deff 31040->31042 31043 70a2dcf7 memcmp 31041->31043 31053 70a2de02 31041->31053 31233 70a2d400 __iob_func abort 31042->31233 31045 70a2dd10 memcmp 31043->31045 31043->31053 31047 70a2dd2f memcmp 31045->31047 31045->31053 31048 70a2dd4f memcmp 31047->31048 31047->31053 31049 70a2dd6f memcmp 31048->31049 31048->31053 31050 70a2dd8f memcmp 31049->31050 31049->31053 31051 70a2ddaf memcmp 31050->31051 31050->31053 31052 70a2ddcf memcmp 31051->31052 31051->31053 31052->31041 31052->31053 31053->30311 31055 70a2dca7 31054->31055 31067 70a2da58 31054->31067 31234 70a2d400 __iob_func abort 31055->31234 31056 70a2da67 memcmp 31058 70a2da80 memcmp 31056->31058 31059 70a2db75 31056->31059 31058->31059 31061 70a2daa2 memcmp 31058->31061 31059->30311 31061->31059 31062 70a2dac2 memcmp 31061->31062 31062->31059 31063 70a2dae2 memcmp 31062->31063 31063->31059 31064 70a2db02 memcmp 31063->31064 31064->31059 31065 70a2db22 memcmp 31064->31065 31065->31059 31066 70a2db42 memcmp 31065->31066 31066->31059 31066->31067 31067->31056 31067->31059 31069 70a2d6f1 31068->31069 31077 70a2d5d6 31068->31077 31235 70a2d400 __iob_func abort 31069->31235 31071 70a2d5e8 strcmp 31073 70a2d6df 31071->31073 31071->31077 31073->30311 31074 70a2d612 strcmp 31074->31073 31074->31077 31075 70a2d631 strcmp 31075->31073 31075->31077 31076 70a2d650 strcmp 31076->31073 31076->31077 31077->31071 31077->31073 31077->31074 31077->31075 31077->31076 31078 70a2d66f strcmp 31077->31078 31079 70a2d68a strcmp 31077->31079 31080 70a2d6a5 strcmp 31077->31080 31081 70a2d6c0 strcmp 31077->31081 31078->31073 31078->31077 31079->31073 31079->31077 31080->31073 31080->31077 31081->31073 31081->31077 31083 70a2d838 31082->31083 31091 70a2d726 31082->31091 31236 70a2d400 __iob_func abort 31083->31236 31086 70a2d738 strcmp 31087 70a2d826 31086->31087 31086->31091 31087->30311 31088 70a2d75c strcmp 31088->31087 31088->31091 31089 70a2d778 strcmp 31089->31087 31089->31091 31090 70a2d797 strcmp 31090->31087 31090->31091 31091->31086 31091->31087 31091->31088 31091->31089 31091->31090 31092 70a2d7b6 strcmp 31091->31092 31093 70a2d7d1 strcmp 31091->31093 31094 70a2d7ec strcmp 31091->31094 31095 70a2d807 strcmp 31091->31095 31092->31087 31092->31091 31093->31087 31093->31091 31094->31087 31094->31091 31095->31087 31095->31091 31097 70a70bee 31096->31097 31237 70a70db9 31097->31237 31099 70a70c23 exit 31100 70a70c3e 31099->31100 31100->30311 31101 70a70bf3 31101->31099 31240 70a70de0 GetCurrentThread GetThreadContext 31101->31240 31103 70a70c05 31103->31099 31104 70a70c09 31103->31104 31104->30311 31247 70a6ffb0 31105->31247 31107 70a04a15 31108 70a04a25 free 31107->31108 31109 70a04a63 31107->31109 31121 70a05fd0 31108->31121 31262 70a04230 7 API calls 31109->31262 31111 70a04a76 31112 70a04b20 fprintf 31111->31112 31113 70a04a82 _errno 31111->31113 31117 70a04ae8 fprintf 31112->31117 31114 70a04b54 _errno strerror fprintf 31113->31114 31115 70a04a96 31113->31115 31114->31115 31118 70a04aba fprintf fputc fclose 31115->31118 31120 70a04b0b fputc 31117->31120 31118->31117 31120->31108 31122 70a05ff2 31121->31122 31187 70a0609d 31121->31187 31123 70a06110 malloc 31122->31123 31124 70a06010 31122->31124 31125 70a0612a memcpy 31123->31125 31126 70a061b1 malloc 31124->31126 31127 70a0602e 31124->31127 31125->30311 31126->31125 31128 70a060fa 31127->31128 31130 70a06150 malloc 31127->31130 31131 70a0605f getenv 31127->31131 31128->30311 31130->31125 31147 70a06074 31131->31147 31133 70a060e8 free 31133->31128 31134 70a0617c free 31138 70a06184 31134->31138 31135 70a064e1 _errno 31139 70a066b3 _errno strerror fprintf 31135->31139 31140 70a064ef fprintf fprintf fputc fclose 31135->31140 31136 70a0631c _errno 31136->31147 31137 70a06420 _access 31137->31147 31137->31187 31143 70a06195 31138->31143 31153 70a061f8 31138->31153 31139->31147 31140->31187 31141 70a06340 free 31141->31187 31142 70a061f1 free 31142->31138 31156 70a061a4 _errno 31143->31156 31157 70a0664e _errno strerror 31143->31157 31144 70a06617 fprintf 31144->31187 31146 70a024c0 strlen strlen malloc _strdup 31146->31187 31147->31136 31147->31137 31148 70a06585 getenv 31147->31148 31149 70a0635d strlen strlen malloc 31147->31149 31150 70a067fe 31147->31150 31160 70a065ae getenv 31147->31160 31147->31187 31148->31147 31154 70a065c6 31149->31154 31149->31187 31356 70a04230 7 API calls 31150->31356 31151 70a0654f fprintf 31165 70a06564 fputc 31151->31165 31152 70a06217 _errno 31161 70a0623a 8 API calls 31152->31161 31162 70a0621f _errno strerror fprintf 31152->31162 31153->31152 31168 70a0668a fprintf 31153->31168 31350 70a04230 7 API calls 31153->31350 31163 70a06719 31154->31163 31180 70a065db 31154->31180 31155 70a0644e 31353 70a04900 15 API calls 31155->31353 31156->31128 31157->31180 31159 70a06811 31166 70a0689c 31159->31166 31167 70a0681d _errno 31159->31167 31160->31149 31160->31154 31174 70a062b2 fprintf 31161->31174 31162->31161 31355 70a04230 7 API calls 31163->31355 31165->31147 31177 70a068e3 fprintf 31166->31177 31188 70a068aa fprintf 31166->31188 31171 70a06846 fprintf fprintf fputc fclose 31167->31171 31172 70a0682b _errno strerror fprintf 31167->31172 31168->31139 31170 70a06459 free 31170->31128 31176 70a0646d 31170->31176 31171->31166 31172->31171 31173 70a0672c 31178 70a06738 _errno 31173->31178 31179 70a06795 31173->31179 31186 70a062ca fputc 31174->31186 31181 70a06930 31176->31181 31182 70a0647a 31176->31182 31177->31166 31184 70a06910 _errno strerror fprintf 31178->31184 31185 70a06743 fprintf fprintf fputc fclose 31178->31185 31191 70a067d8 fprintf 31179->31191 31200 70a067a3 fprintf 31179->31200 31180->31156 31357 70a04230 7 API calls 31181->31357 31182->31156 31192 70a06490 _errno strerror 31182->31192 31184->31181 31185->31179 31186->31187 31187->31133 31187->31134 31187->31135 31187->31136 31187->31141 31187->31142 31187->31144 31187->31146 31187->31147 31187->31148 31187->31149 31187->31151 31187->31155 31349 70a04900 15 API calls 31187->31349 31351 70a05f60 6 API calls 31187->31351 31352 70a04900 15 API calls 31187->31352 31354 70a04230 7 API calls 31187->31354 31196 70a068c3 fputc 31188->31196 31189 70a06943 31193 70a06a0b fprintf 31189->31193 31194 70a0694f _errno 31189->31194 31191->31179 31201 70a064bd 31192->31201 31202 70a069c3 _errno strerror 31193->31202 31197 70a06961 6 API calls 31194->31197 31198 70a06a49 _errno strerror fprintf 31194->31198 31195 70a063f8 free 31195->31138 31199 70a0640c 31195->31199 31196->31166 31197->31202 31199->31128 31204 70a067b8 fputc 31200->31204 31201->31156 31205 70a069dd fprintf 31202->31205 31204->31179 31206 70a069f9 fputc 31205->31206 31206->31193 31208 70a05fd0 107 API calls 31207->31208 31209 70a0da2a 31208->31209 31210 70a0da80 31209->31210 31211 70a0da32 31209->31211 31213 70a0daa0 31210->31213 31214 70a0da91 _errno 31210->31214 31358 70a0a7b0 31211->31358 31774 70a04230 7 API calls 31213->31774 31216 70a0da74 31214->31216 31216->30311 31218 70a0dab3 31219 70a0db4c fprintf 31218->31219 31220 70a0dabf _errno 31218->31220 31223 70a0db1a fprintf 31219->31223 31221 70a0db80 _errno strerror fprintf 31220->31221 31222 70a0dacb fprintf fprintf fputc fclose 31220->31222 31221->31222 31222->31223 31226 70a0db3a fputc 31223->31226 31226->31214 31227->30391 31228->30979 31229->30339 31230->30311 31231->30500 31243 70a70c90 31237->31243 31242 70a70e1e GetCurrentThread SetThreadContext 31240->31242 31242->31103 31244 70a70ca4 31243->31244 31245 70a70cf2 31244->31245 31246 70a70cd7 RtlWow64SetThreadContext 31244->31246 31245->31101 31246->31245 31263 70a70f40 31247->31263 31249 70a70002 malloc 31250 70a70023 memcpy 31249->31250 31251 70a700de 31249->31251 31250->31251 31261 70a70045 31250->31261 31251->31107 31252 70a77660 abort 31252->31261 31254 70a7bf10 fwrite abort 31254->31261 31261->31251 31261->31252 31261->31254 31264 70a94120 31261->31264 31292 70a75cf0 31261->31292 31315 70a76e80 31261->31315 31319 70a7c3e0 fwrite abort 31261->31319 31320 70a75ec0 free UnmapViewOfFile GetLastError _errno 31261->31320 31321 70a76e80 abort 31261->31321 31322 70a775c0 abort 31261->31322 31262->31111 31263->31249 31265 70a9413c 31264->31265 31280 70a942f9 31264->31280 31266 70a942e0 31265->31266 31268 70a942b9 31265->31268 31269 70a9415a 31265->31269 31271 70a94ed0 9 API calls 31266->31271 31266->31280 31327 70a94ed0 31268->31327 31340 70a82d40 fwrite abort abort memset abort 31269->31340 31271->31280 31272 70a943b9 memset 31272->31280 31275 70a70fe0 free 31275->31280 31276 70a94245 31278 70a94257 31276->31278 31276->31280 31277 70a9425d 31323 70a96550 31277->31323 31278->31277 31282 70a94283 31278->31282 31280->31272 31280->31275 31280->31277 31346 70a7ac80 11 API calls 31280->31346 31347 70a949c0 memcpy free 31280->31347 31281 70a94185 31281->31276 31284 70a9427a 31281->31284 31290 70a941d8 31281->31290 31343 70a70fe0 31282->31343 31283 70a94270 31283->31284 31286 70a96550 VirtualProtect 31283->31286 31284->31261 31288 70a942ac 31286->31288 31288->31261 31289 70a94ed0 9 API calls 31289->31290 31290->31276 31290->31281 31290->31289 31341 70a950a0 UnmapViewOfFile GetLastError _errno 31290->31341 31342 70a82d40 fwrite abort abort memset abort 31290->31342 31293 70a70fe0 free 31292->31293 31294 70a75d1e 31293->31294 31295 70a70fe0 free 31294->31295 31296 70a75d2b 31295->31296 31297 70a70fe0 free 31296->31297 31298 70a75d48 31297->31298 31299 70a70fe0 free 31298->31299 31300 70a75d58 31299->31300 31301 70a70fe0 free 31300->31301 31302 70a75d68 31301->31302 31303 70a70fe0 free 31302->31303 31304 70a75d78 31303->31304 31305 70a70fe0 free 31304->31305 31311 70a75d88 31305->31311 31306 70a75ddf 31307 70a70fe0 free 31306->31307 31310 70a75deb 31307->31310 31308 70a70fe0 free 31308->31311 31309 70a75e41 31312 70a70fe0 free 31309->31312 31310->31309 31313 70a70fe0 free 31310->31313 31311->31306 31311->31308 31314 70a75e4d 31312->31314 31313->31310 31316 70a76e9d 31315->31316 31318 70a76ea5 31315->31318 31316->31318 31348 70a76840 abort 31316->31348 31318->31261 31319->31261 31320->31261 31321->31261 31322->31261 31326 70a9655a 31323->31326 31324 70a96586 VirtualProtect 31325 70a9659e 31324->31325 31325->31283 31326->31324 31326->31325 31328 70a94eea 31327->31328 31329 70a94f27 _errno 31328->31329 31333 70a95088 31328->31333 31330 70a94f3f 31329->31330 31331 70a94ff0 _errno 31329->31331 31330->31331 31334 70a94f52 31330->31334 31332 70a94fff 31331->31332 31332->31266 31335 70a94f63 CreateFileMappingA 31334->31335 31336 70a95054 _get_osfhandle 31334->31336 31338 70a94fc8 GetLastError _errno 31335->31338 31339 70a94f93 MapViewOfFile CloseHandle 31335->31339 31336->31335 31337 70a9506e _errno 31336->31337 31337->31332 31338->31266 31339->31332 31339->31338 31340->31281 31341->31290 31342->31290 31344 70a70ff0 free 31343->31344 31345 70a70ffd 31343->31345 31344->31345 31345->31283 31346->31280 31347->31280 31348->31318 31349->31187 31350->31153 31351->31187 31352->31195 31353->31170 31354->31187 31355->31173 31356->31159 31357->31189 31359 70a0a7c6 31358->31359 31360 70a05fd0 107 API calls 31359->31360 31361 70a0a7f7 31360->31361 31362 70a0afd0 31361->31362 31363 70a0a803 31361->31363 31364 70a0acd4 _errno 31362->31364 31365 70a0afe7 31362->31365 31775 70a2bd40 31363->31775 31424 70a0ad43 free 31364->31424 31936 70a04230 7 API calls 31365->31936 31369 70a0affa 31373 70a0b006 _errno 31369->31373 31486 70a0c7f0 fprintf 31369->31486 31370 70a0bea1 free 31394 70a0acc5 31370->31394 31717 70a0c6e8 31370->31717 31371 70a0ac80 31382 70a0aca0 free free 31371->31382 31372 70a0a83a strncmp 31375 70a0a8b0 31372->31375 31376 70a0a89a strchr 31372->31376 31377 70a0b014 fprintf fputc fclose 31373->31377 31378 70a0ce6e _errno strerror fprintf 31373->31378 31381 70a0a420 55 API calls 31375->31381 31376->31375 31380 70a0c2e1 31376->31380 31389 70a0b05b fputc 31377->31389 31384 70a0ce8e fprintf 31378->31384 31379 70a0c715 31385 70a0c721 _errno 31379->31385 31386 70a0ccc6 fprintf 31379->31386 31388 70a0c2f8 31380->31388 31380->31394 31387 70a0a8ef 31381->31387 31490 70a0acb0 31382->31490 31403 70a0b531 fprintf 31384->31403 31390 70a0d201 _errno strerror fprintf 31385->31390 31391 70a0c72d fprintf 31385->31391 31413 70a0ccfd 31386->31413 31392 70a0ad62 free 31387->31392 31393 70a0a8fb 31387->31393 31956 70a04230 7 API calls 31388->31956 31389->31364 31626 70a0b840 31390->31626 31960 70a2df20 31391->31960 31392->31490 31805 70a30380 31393->31805 31394->31364 31395 70a0c850 31398 70a0c867 31395->31398 31627 70a0bc2a 31395->31627 31962 70a04230 7 API calls 31398->31962 31399 70a0c30b 31407 70a0c317 _errno 31399->31407 31438 70a0d105 31399->31438 31433 70a0b551 fputc 31403->31433 31404 70a0c758 fprintf fputc fclose 31421 70a0c78d 31404->31421 31411 70a0c321 _errno strerror fprintf 31407->31411 31412 70a0c33c fprintf fprintf fputc fclose 31407->31412 31408 70a0b85f _errno 31415 70a0b882 fprintf 31408->31415 31416 70a0b867 _errno strerror fprintf 31408->31416 31409 70a0c87a 31419 70a0d415 fprintf 31409->31419 31420 70a0c886 _errno 31409->31420 31410 70a04230 7 API calls 31410->31626 31411->31412 31429 70a0c399 fprintf 31412->31429 31965 70a04230 7 API calls 31413->31965 31414 70a0bc4c _errno 31414->31424 31449 70a0b8e2 31415->31449 31416->31415 31450 70a0d44c _errno strerror fprintf 31419->31450 31426 70a0c894 fprintf fprintf fputc fclose 31420->31426 31427 70a0d74d _errno strerror fprintf 31420->31427 31437 70a0c79e fprintf 31421->31437 31423 70a0d14a fprintf 31423->31438 31424->31216 31442 70a0c8f1 fprintf 31426->31442 31427->31490 31428 70a0d240 _errno 31436 70a0d251 _errno strerror fprintf 31428->31436 31428->31626 31444 70a0c3ab fputc 31429->31444 31430 70a0c923 fprintf 31445 70a0c950 memcpy 31430->31445 31431 70a0cd10 31431->31438 31439 70a0cd1c _errno 31431->31439 31432 70a0b8ad fprintf fputc fclose 31432->31449 31433->31394 31436->31626 31451 70a0c7b3 fputc 31437->31451 31438->31423 31448 70a0d181 fprintf 31438->31448 31452 70a0d113 fprintf 31438->31452 31468 70a0d1b8 fprintf 31438->31468 31446 70a0cd41 fprintf 31439->31446 31447 70a0cd26 _errno strerror fprintf 31439->31447 31440 70a0d599 fprintf 31440->31626 31441 70a0a974 31441->31382 31465 70a0a97c 31441->31465 31454 70a0c903 fputc 31442->31454 31443 70a0d27a fprintf fprintf fputc fclose 31443->31626 31444->31394 31445->31490 31478 70a0cd8b 31446->31478 31447->31446 31448->31438 31449->31432 31455 70a0b8f3 fprintf 31449->31455 31457 70a0d46c 31450->31457 31459 70a0c7c5 31451->31459 31452->31438 31453 70a0a98d free free 31456 70a0a9ac 31453->31456 31453->31490 31454->31627 31469 70a0b908 fputc 31455->31469 31462 70a0a9b5 strncmp 31456->31462 31456->31490 31968 70a04230 7 API calls 31457->31968 31458 70a0d2c9 fprintf 31474 70a0d2db fputc 31458->31474 31961 70a04230 7 API calls 31459->31961 31460 70a0d5d7 fprintf 31479 70a0d600 _errno strerror fprintf 31460->31479 31461 70a0bd19 strncmp 31461->31424 31461->31490 31470 70a0a9dd strncmp 31462->31470 31496 70a0aeb0 31462->31496 31463 70a0bf57 31463->31394 31950 70a04230 7 API calls 31463->31950 31465->31453 31473 70a04a00 48 API calls 31465->31473 31487 70a0d1e1 _errno strerror fprintf 31468->31487 31469->31490 31480 70a0ad74 atof _time64 31470->31480 31481 70a0a9fa 31470->31481 31471 70a0b7b9 strncmp 31471->31463 31471->31490 31472 70a0d47f 31483 70a0d70c fprintf 31472->31483 31484 70a0d48b _errno 31472->31484 31485 70a0ae67 31473->31485 31495 70a0d2ed free 31474->31495 31475 70a0c7d8 31476 70a0c7e4 _errno 31475->31476 31477 70a0cc8f fprintf 31475->31477 31476->31486 31476->31487 31477->31386 31966 70a04230 7 API calls 31478->31966 31503 70a0d620 _errno strerror fprintf 31479->31503 31500 70a0b563 31480->31500 31501 70a0add6 31480->31501 31481->31490 31491 70a0aa06 strncmp 31481->31491 31509 70a0c179 fprintf 31483->31509 31493 70a0c12a fprintf fprintf fputc fclose 31484->31493 31494 70a0d9b8 _errno strerror fprintf 31484->31494 31485->31453 31486->31395 31487->31390 31490->31394 31490->31424 31490->31461 31490->31463 31490->31471 31490->31483 31499 70a0b708 _errno 31490->31499 31490->31626 31490->31627 31504 70a0aa29 31491->31504 31513 70a0aa4a 31491->31513 31492 70a0bf9a 31505 70a0bfa6 _errno 31492->31505 31506 70a0ce37 fprintf 31492->31506 31493->31509 31518 70a0d9d8 _errno strerror fprintf 31494->31518 31508 70a0d640 31495->31508 31495->31627 31515 70a0aee1 31496->31515 31517 70a0b2e9 31496->31517 31533 70a0b28a sprintf strstr 31496->31533 31497 70a0cd9e 31497->31438 31516 70a0cdaa _errno 31497->31516 31499->31424 31510 70a0b571 31500->31510 31511 70a0ba62 31500->31511 31501->31394 31501->31490 31522 70a0bb50 31501->31522 31503->31508 31512 70a0be80 _time64 31504->31512 31504->31513 31520 70a0bfb0 _errno strerror fprintf 31505->31520 31521 70a0bfcb 31505->31521 31506->31378 31541 70a0d8a5 fprintf 31508->31541 31542 70a0d65f _errno 31508->31542 31970 70a04230 7 API calls 31508->31970 31566 70a0c199 fputc 31509->31566 31510->31364 31547 70a0b587 _errno strerror 31510->31547 31945 70a04230 7 API calls 31511->31945 31512->31370 31513->31424 31513->31490 31514 70a0aa84 strncmp 31513->31514 31523 70a0af30 31514->31523 31524 70a0aaa9 strncmp 31514->31524 31515->31394 31525 70a0b962 31515->31525 31516->31503 31526 70a0cdb6 fprintf fprintf fputc fclose 31516->31526 31517->31394 31517->31459 31517->31490 31518->31490 31520->31521 31521->31394 31560 70a0bff7 31521->31560 31946 70a04230 7 API calls 31522->31946 31535 70a0b740 31523->31535 31536 70a0af4e 31523->31536 31532 70a0b070 31524->31532 31725 70a0aac9 31524->31725 31944 70a04230 7 API calls 31525->31944 31552 70a0ce13 fprintf 31526->31552 31529 70a0bc7f _errno 31544 70a0d0e5 _errno strerror fprintf 31529->31544 31545 70a0bc8b fprintf fprintf fputc fclose 31529->31545 31543 70a0b091 31532->31543 31692 70a0c442 31532->31692 31550 70a0b2c3 strcmp 31533->31550 31551 70a0d054 strstr 31533->31551 31534 70a0ba75 31553 70a0ba81 _errno 31534->31553 31554 70a0ca09 fprintf 31534->31554 31943 70a230c0 24 API calls 31535->31943 31574 70a0c1b0 31536->31574 31591 70a0af67 31536->31591 31538 70a0cfa8 fprintf 31601 70a0cfdf fprintf 31538->31601 31539 70a0caad _errno 31556 70a0cad2 fprintf fprintf fputc fclose 31539->31556 31557 70a0cab7 _errno strerror fprintf 31539->31557 31607 70a0d8dc fprintf 31541->31607 31542->31518 31559 70a0d66a fprintf fprintf fputc fclose 31542->31559 31561 70a0b09c 31543->31561 31562 70a0b100 31543->31562 31544->31438 31581 70a0bce8 fprintf 31545->31581 31546 70a0d7d1 _errno 31565 70a0d7d8 _errno strerror fprintf 31546->31565 31546->31626 31547->31394 31548 70a0b975 31567 70a0b981 _errno 31548->31567 31568 70a0c968 fprintf 31548->31568 31549 70a0aad2 strncmp 31569 70a0b3c0 31549->31569 31570 70a0aaf8 strncmp 31549->31570 31550->31515 31550->31517 31551->31550 31564 70a0d071 strstr 31551->31564 31590 70a0ce25 fputc 31552->31590 31572 70a0ba90 _errno strerror fprintf 31553->31572 31573 70a0baab 8 API calls 31553->31573 31576 70a0ca57 fprintf 31554->31576 31593 70a0cb2f fprintf 31556->31593 31557->31556 31558 70a0bb63 31558->31576 31577 70a0bb6f _errno 31558->31577 31597 70a0d6c7 fprintf 31559->31597 31951 70a04230 7 API calls 31560->31951 31937 70a230c0 24 API calls 31561->31937 31582 70a0b113 31562->31582 31602 70a0c0d3 31562->31602 31564->31550 31583 70a0d08e strstr 31564->31583 31565->31626 31566->31394 31585 70a0cf51 _errno strerror fprintf 31567->31585 31586 70a0b98d fprintf fprintf fputc fclose 31567->31586 31634 70a0c99f 31568->31634 31939 70a230c0 24 API calls 31569->31939 31587 70a0b5b2 31570->31587 31588 70a0ab18 strncmp 31570->31588 31572->31573 31609 70a0bb20 fprintf 31573->31609 31574->31394 31584 70a0c1c7 31574->31584 31575 70a0b755 31575->31394 31575->31490 31957 70a04230 7 API calls 31575->31957 31576->31626 31594 70a0bb94 fprintf fprintf fputc fclose 31577->31594 31595 70a0bb79 _errno strerror fprintf 31577->31595 31578 70a0cb61 fprintf 31578->31490 31616 70a0bcfa fputc 31581->31616 31582->31634 31710 70a0b0b4 31582->31710 31583->31550 31954 70a04230 7 API calls 31584->31954 31629 70a0cf71 fprintf 31585->31629 31620 70a0b9f1 fprintf 31586->31620 31941 70a230c0 24 API calls 31587->31941 31606 70a0ab35 strncmp 31588->31606 31588->31725 31590->31506 31935 70a22f50 60 API calls 31591->31935 31592 70a0d98f fprintf 31592->31494 31623 70a0cb41 fputc 31593->31623 31624 70a0bbf1 fprintf 31594->31624 31595->31594 31625 70a0d6d9 fputc 31597->31625 31598 70a0c00a 31598->31384 31599 70a0c016 _errno 31598->31599 31611 70a0b258 fprintf fprintf fputc fclose 31599->31611 31612 70a0c01e _errno strerror fprintf 31599->31612 31600 70a0da02 31663 70a0d016 fprintf 31601->31663 31602->31394 31615 70a0c0e8 31602->31615 31606->31490 31621 70a0ab52 strchr 31606->31621 31607->31403 31642 70a0bb35 fputc 31609->31642 31611->31403 31612->31611 31613 70a0b0bc 31613->31394 31613->31457 31614 70a0c5a9 31614->31394 31958 70a04230 7 API calls 31614->31958 31953 70a04230 7 API calls 31615->31953 31616->31490 31618 70a0b5dc 31636 70a0ba20 31618->31636 31637 70a0b5e7 31618->31637 31619 70a0c1da 31619->31601 31638 70a0c1e6 _errno 31619->31638 31653 70a0ba0a fputc 31620->31653 31639 70a0bc15 31621->31639 31640 70a0ab6d 31621->31640 31622 70a0af88 31622->31445 31643 70a0af90 31622->31643 31623->31626 31657 70a0bc03 fputc 31624->31657 31625->31490 31626->31408 31626->31410 31626->31428 31626->31430 31626->31440 31626->31443 31626->31458 31626->31460 31626->31529 31626->31538 31626->31539 31626->31546 31626->31578 31626->31592 31635 70a0d814 fprintf 31626->31635 31660 70a0d351 _errno 31626->31660 31627->31414 31629->31538 31631 70a0c4e2 isxdigit 31631->31614 31631->31692 31634->31394 31652 70a0c9b4 31634->31652 31635->31626 31636->31394 31654 70a0cbca 31636->31654 31637->31521 31637->31637 31679 70a0b63e strncmp 31637->31679 31650 70a0d4e0 _errno strerror fprintf 31638->31650 31651 70a0c1f4 fprintf fprintf fputc fclose 31638->31651 31639->31413 31639->31627 31655 70a0ab7a strchr 31640->31655 31716 70a0c670 strchr 31640->31716 31642->31522 31643->31394 31656 70a0cec5 31643->31656 31644 70a0c428 31644->31438 31645 70a0c434 _errno 31644->31645 31645->31479 31645->31692 31647 70a0c0fb 31647->31629 31664 70a0c107 _errno 31647->31664 31648 70a0c3c0 31648->31394 31648->31478 31680 70a0ac3b 31650->31680 31681 70a0c243 fprintf 31651->31681 31963 70a04230 7 API calls 31652->31963 31653->31636 31964 70a04230 7 API calls 31654->31964 31655->31395 31669 70a0ab97 31655->31669 31967 70a04230 7 API calls 31656->31967 31657->31639 31658 70a0bf00 31658->31394 31949 70a04230 7 API calls 31658->31949 31659 70a0b3ea 31659->31490 31659->31658 31671 70a0b44c strncmp 31659->31671 31672 70a0d885 _errno strerror fprintf 31660->31672 31673 70a0d35d fprintf fprintf fputc fclose 31660->31673 31662 70a0c4ff isxdigit 31662->31614 31662->31692 31663->31403 31664->31493 31675 70a0c10f _errno strerror fprintf 31664->31675 31665 70a0c275 31665->31394 31683 70a0c28a 31665->31683 31666 70a0c5d8 31677 70a0d554 fprintf 31666->31677 31678 70a0c5e4 _errno 31666->31678 31933 70a024c0 strlen strlen malloc _strdup 31669->31933 31671->31658 31688 70a0b464 31671->31688 31672->31541 31707 70a0d3ba fprintf 31673->31707 31674 70a0cbdd 31690 70a0cbe9 _errno 31674->31690 31691 70a0d0ae fprintf 31674->31691 31675->31493 31676 70a0c080 31676->31394 31689 70a0c095 31676->31689 31677->31626 31678->31394 31694 70a0c5ec _errno strerror fprintf 31678->31694 31679->31521 31695 70a0b656 31679->31695 31773 70a0ac52 31680->31773 31969 70a04230 7 API calls 31680->31969 31740 70a0c263 fputc 31681->31740 31682 70a0c9c7 31697 70a0c9d3 _errno 31682->31697 31698 70a0d4a9 fprintf 31682->31698 31955 70a04230 7 API calls 31683->31955 31687 70a0ced8 31704 70a0cee4 _errno 31687->31704 31705 70a0d3de fprintf 31687->31705 31688->31394 31688->31490 31720 70a0b49e 31688->31720 31952 70a04230 7 API calls 31689->31952 31708 70a0cbf3 _errno strerror fprintf 31690->31708 31709 70a0cc0e fprintf fprintf fputc fclose 31690->31709 31691->31544 31692->31486 31692->31554 31692->31600 31692->31614 31692->31631 31692->31662 31692->31725 31744 70a0c577 memcmp 31692->31744 31693 70a0bddb strncmp 31693->31676 31693->31725 31694->31394 31695->31490 31727 70a0b679 31695->31727 31697->31493 31713 70a0c9db _errno strerror fprintf 31697->31713 31698->31509 31700 70a0aba2 31700->31490 31934 70a04900 15 API calls 31700->31934 31701 70a0c6d3 atof 31701->31490 31701->31717 31702 70a0c6b5 atof 31702->31490 31702->31716 31703 70a0bf28 31703->31446 31718 70a0bf34 _errno 31703->31718 31704->31651 31719 70a0ceec _errno strerror fprintf 31704->31719 31705->31681 31735 70a0d3cc fputc 31707->31735 31708->31709 31736 70a0cc6b fprintf 31709->31736 31710->31613 31710->31665 31710->31725 31711 70a0d513 31711->31626 31728 70a0d51f _errno 31711->31728 31713->31493 31715 70a0c29d 31715->31663 31729 70a0c2a9 _errno 31715->31729 31716->31701 31716->31702 31717->31626 31959 70a04230 7 API calls 31717->31959 31718->31463 31731 70a0bf3c _errno strerror fprintf 31718->31731 31719->31651 31940 70a04230 7 API calls 31720->31940 31721 70a0c0a8 31733 70a0c0b4 _errno 31721->31733 31734 70a0cf1a fprintf 31721->31734 31725->31490 31725->31549 31725->31614 31725->31648 31725->31676 31725->31693 31737 70a0be15 31725->31737 31751 70a0b200 31725->31751 31947 70a230c0 24 API calls 31725->31947 31727->31394 31738 70a0b68e 31727->31738 31728->31626 31739 70a0d526 _errno strerror fprintf 31728->31739 31729->31611 31741 70a0c2b3 _errno strerror fprintf 31729->31741 31731->31463 31733->31450 31733->31611 31734->31403 31735->31705 31750 70a0cc7d fputc 31736->31750 31737->31394 31745 70a0be2a 31737->31745 31942 70a04230 7 API calls 31738->31942 31739->31626 31740->31394 31741->31611 31742 70a0abbb 31742->31495 31747 70a0abca free 31742->31747 31743 70a0b4b1 31748 70a0d94a fprintf 31743->31748 31749 70a0b4bd _errno 31743->31749 31744->31692 31948 70a04230 7 API calls 31745->31948 31747->31663 31754 70a0abde 31747->31754 31748->31626 31749->31611 31756 70a0b4c4 _errno strerror fprintf 31749->31756 31750->31477 31751->31394 31757 70a0b217 31751->31757 31753 70a0b6a1 31759 70a0d913 fprintf 31753->31759 31760 70a0b6ad _errno 31753->31760 31754->31663 31768 70a0ac0b free atof 31754->31768 31756->31611 31938 70a04230 7 API calls 31757->31938 31758 70a0be3d 31758->31607 31762 70a0be49 _errno 31758->31762 31759->31403 31760->31611 31763 70a0b6b4 _errno strerror fprintf 31760->31763 31762->31611 31766 70a0be50 _errno strerror fprintf 31762->31766 31763->31611 31765 70a0b22a 31769 70a0b236 _errno 31765->31769 31770 70a0d77b fprintf 31765->31770 31766->31611 31768->31490 31768->31680 31769->31611 31771 70a0b23d _errno strerror fprintf 31769->31771 31770->31403 31771->31611 31773->31414 31774->31218 31776 70a2bd51 31775->31776 31777 70a2c16a 31775->31777 31779 70a2c151 31776->31779 31789 70a0a820 31776->31789 31971 70a2d400 __iob_func abort 31776->31971 31973 70a2d400 __iob_func abort 31777->31973 31972 70a2d400 __iob_func abort 31779->31972 31789->31370 31789->31371 31789->31372 31806 70a303a0 31805->31806 31807 70a307fc 31805->31807 31808 70a307e3 31806->31808 31811 70a303bb 31806->31811 31812 70a307ca 31806->31812 31981 70a2d400 __iob_func abort 31807->31981 31808->31807 31980 70a2d400 __iob_func abort 31808->31980 31821 70a0a916 31811->31821 31822 70a30415 calloc 31811->31822 31979 70a2d400 __iob_func abort 31812->31979 31821->31382 31848 70a30fc0 31821->31848 31824 70a30434 31822->31824 31829 70a30518 31822->31829 31974 70a334c0 6 API calls 31824->31974 31826 70a3046a 31827 70a304e0 31826->31827 31828 70a3046e 31826->31828 31976 70a33350 __iob_func abort calloc free 31827->31976 31975 70a33350 __iob_func abort calloc free 31828->31975 31834 70a305d3 31829->31834 31835 70a30740 31829->31835 31841 70a304c4 31829->31841 31834->31841 31977 70a33350 __iob_func abort calloc free 31834->31977 31835->31841 31978 70a33350 __iob_func abort calloc free 31835->31978 31836 70a304ce free 31836->31821 31841->31836 31849 70a3125b 31848->31849 31850 70a30fff 31848->31850 31986 70a2d400 __iob_func abort 31849->31986 31852 70a31242 31850->31852 31854 70a31229 31850->31854 31857 70a31210 31850->31857 31864 70a3101a 31850->31864 31985 70a2d400 __iob_func abort 31852->31985 31853 70a31274 memcmp 31856 70a3117e free 31853->31856 31886 70a3128a 31853->31886 31984 70a2d400 __iob_func abort 31854->31984 31859 70a31186 free 31856->31859 31983 70a2d400 __iob_func abort 31857->31983 31862 70a31195 31859->31862 31861 70a0a968 31887 70a30310 31861->31887 31862->31859 31863 70a36f00 22 API calls 31862->31863 31863->31862 31864->31861 31865 70a31094 malloc 31864->31865 31865->31861 31866 70a310ab 31865->31866 31866->31859 31867 70a310ea free 31866->31867 31868 70a310fe 31866->31868 31867->31861 31868->31862 31869 70a31107 malloc 31868->31869 31869->31859 31870 70a31139 31869->31870 31982 70a37b90 memcpy 31870->31982 31872 70a31168 31872->31856 31873 70a31173 31872->31873 31874 70a311e1 31872->31874 31873->31853 31873->31856 31874->31862 31987 70a328a0 __iob_func abort 31874->31987 31876 70a31391 31877 70a313db 31876->31877 31988 70a328a0 __iob_func abort 31876->31988 31881 70a3147d free 31877->31881 31989 70a33ba0 __iob_func abort 31877->31989 31880 70a313f8 31880->31881 31882 70a313ff 31880->31882 31882->31856 31883 70a3142d memcmp 31882->31883 31883->31856 31884 70a3144f 31883->31884 31884->31856 31885 70a3145d memcmp 31884->31885 31885->31856 31885->31886 31886->31856 31888 70a30364 31887->31888 31889 70a3031c 31887->31889 31990 70a2d400 __iob_func abort 31888->31990 31889->31441 31933->31700 31934->31742 31935->31622 31936->31369 31937->31710 31938->31765 31939->31659 31940->31743 31941->31618 31942->31753 31943->31575 31944->31548 31945->31534 31946->31558 31947->31725 31948->31758 31949->31703 31950->31492 31951->31598 31952->31721 31953->31647 31954->31619 31955->31715 31956->31399 31957->31644 31958->31666 31959->31379 31960->31404 31961->31475 31962->31409 31963->31682 31964->31674 31965->31431 31966->31497 31967->31687 31968->31472 31969->31711 31970->31508 31974->31826 31975->31841 31976->31829 31977->31841 31978->31841 31982->31872 31987->31876 31988->31877 31989->31880
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strncmp$free$_errnofprintf$fputc$strchr$atoffclose$_time64getenvstrerror
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$*$*CODE:$*DOMAIN:$*FIXKEY:$*FLAGS:$*HARDDISK:$*IFIPV4:$*IFIPV6:$*IFMAC:$*TIME:$*VERSION:$Pyarmor$_vax_%s$clickbank$license.c$pyarmor-test-0001$pytransform.log$regnow$shareit
                                                                                                                                                                                                                            • API String ID: 1877277240-1732257083
                                                                                                                                                                                                                            • Opcode ID: 0ab194c1bf24722a606870c51134e8615c4c9e8748de1bb9da5860feec46e328
                                                                                                                                                                                                                            • Instruction ID: 9e1d1b8ada2dcebee2fe6bcc057d11c69bf52c235d1179b5613465b19a765894
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0ab194c1bf24722a606870c51134e8615c4c9e8748de1bb9da5860feec46e328
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 42338B7171874ADAEB159B21FA1079D23A5FB88BC4F44422AD94E5B36CEF3CE509C312

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2169 70a0e6f0-70a0e73f 2170 70a0e9e2-70a0e9e4 2169->2170 2171 70a0e745-70a0e74d 2169->2171 2174 70a0e92e-70a0e93d 2170->2174 2172 70a0e940-70a0e947 2171->2172 2173 70a0e753-70a0e75b 2171->2173 2175 70a0e917-70a0e91e 2172->2175 2173->2172 2176 70a0e761-70a0e791 2173->2176 2178 70a0e927-70a0e929 call 70a01c70 2175->2178 2179 70a0e910 2176->2179 2180 70a0e797-70a0e79f 2176->2180 2178->2174 2179->2175 2182 70a0ea74-70a0ea90 call 70a01c70 2180->2182 2183 70a0e7a5-70a0e7b1 2180->2183 2182->2174 2187 70a0e980-70a0e989 2183->2187 2188 70a0e7b7-70a0e7bc 2183->2188 2189 70a0ea30-70a0ea37 2187->2189 2190 70a0e98f-70a0e996 2187->2190 2194 70a0e7c4-70a0e7e3 2188->2194 2189->2190 2192 70a0ea3d-70a0ea49 2189->2192 2193 70a0e999-70a0e9a0 2190->2193 2192->2193 2193->2194 2195 70a0e9a6-70a0e9b8 2193->2195 2194->2175 2198 70a0e7e9-70a0e7ff 2194->2198 2195->2194 2197 70a0e9be-70a0e9cb 2195->2197 2199 70a0e9d1-70a0e9dd 2197->2199 2200 70a0ea95-70a0ea98 2197->2200 2206 70a0e9f0-70a0ea0c call 70a01c70 2198->2206 2207 70a0e805-70a0e829 strlen strncmp 2198->2207 2199->2194 2201 70a0ea9a-70a0eaa1 2200->2201 2202 70a0eaaf-70a0eab6 2200->2202 2203 70a0eaa4-70a0eaaa 2201->2203 2202->2201 2204 70a0eab8-70a0eac4 2202->2204 2203->2199 2204->2203 2206->2174 2208 70a0e881-70a0e896 call 70a0dc10 2207->2208 2209 70a0e82b-70a0e830 2207->2209 2215 70a0e89b-70a0e8a2 2208->2215 2209->2208 2210 70a0e832-70a0e843 2209->2210 2214 70a0e858-70a0e864 2210->2214 2219 70a0e845-70a0e852 2214->2219 2220 70a0e866-70a0e86d 2214->2220 2216 70a0e950-70a0e954 2215->2216 2217 70a0e8a8-70a0e8b8 2215->2217 2221 70a0ea50-70a0ea54 2216->2221 2222 70a0e95a-70a0e973 2216->2222 2225 70a0e8c1-70a0e8c4 2217->2225 2219->2214 2223 70a0eaea 2219->2223 2220->2219 2224 70a0e86f-70a0e877 2220->2224 2226 70a0eac6-70a0eaca 2221->2226 2227 70a0ea56-70a0ea6f 2221->2227 2222->2225 2232 70a0eaf4-70a0eaf8 2223->2232 2224->2208 2228 70a0e879-70a0e87e 2224->2228 2229 70a0e8f4-70a0e8fd 2225->2229 2230 70a0e8c6-70a0e8c9 2225->2230 2226->2232 2233 70a0eacc-70a0eae5 2226->2233 2227->2225 2228->2208 2229->2178 2247 70a0e8ff-70a0e90e 2229->2247 2230->2229 2234 70a0e8cb-70a0e8d2 2230->2234 2236 70a0eb18-70a0eb1c 2232->2236 2237 70a0eafa-70a0eb13 2232->2237 2233->2225 2239 70a0ea11-70a0ea18 2234->2239 2240 70a0e8d8-70a0e8df 2234->2240 2236->2237 2238 70a0eb1e-70a0eb22 2236->2238 2237->2236 2243 70a0eb42-70a0eb46 2238->2243 2244 70a0eb24-70a0eb3d 2238->2244 2239->2240 2245 70a0ea1e-70a0ea2a 2239->2245 2246 70a0e8e2-70a0e8ef 2240->2246 2249 70a0eb66-70a0eb6a 2243->2249 2250 70a0eb48-70a0eb61 2243->2250 2244->2225 2245->2246 2246->2229 2249->2237 2252 70a0eb6c-70a0eb70 2249->2252 2250->2225 2254 70a0eb90-70a0eb94 2252->2254 2255 70a0eb72-70a0eb8b 2252->2255 2256 70a0ebb4-70a0ebb8 2254->2256 2257 70a0eb96-70a0ebaf 2254->2257 2255->2225 2258 70a0ebd8-70a0ebdc 2256->2258 2259 70a0ebba-70a0ebd3 2256->2259 2257->2225 2258->2225 2262 70a0ebe2-70a0ebfb 2258->2262 2259->2225 2262->2225
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • This obfuscated script is obfuscated by old PyArmor, xrefs: 70A0EB4F
                                                                                                                                                                                                                            • Loaded module __main__ not found in sys.modules, xrefs: 70A0EB9D
                                                                                                                                                                                                                            • Check restrict mode of module failed, xrefs: 70A0EAD3
                                                                                                                                                                                                                            • The runtime library doesn't support Advanced Mode, xrefs: 70A0EA5D
                                                                                                                                                                                                                            • <frozen pyarmor>, xrefs: 70A0E6FC
                                                                                                                                                                                                                            • Enable restrict mode failed, xrefs: 70A0EBC1
                                                                                                                                                                                                                            • Restore module failed, xrefs: 70A0EB01
                                                                                                                                                                                                                            • The runtime library doesn't support Super Mode, xrefs: 70A0E961
                                                                                                                                                                                                                            • Marshal loads failed, xrefs: 70A0EB79
                                                                                                                                                                                                                            • Incompatible core library, xrefs: 70A0EBE9
                                                                                                                                                                                                                            • Invalid parameter, xrefs: 70A0E910
                                                                                                                                                                                                                            • Got string from code object failed, xrefs: 70A0E7DC, 70A0E9F7
                                                                                                                                                                                                                            • ssO|i, xrefs: 70A0E770
                                                                                                                                                                                                                            • Check the restrict mode of module failed, xrefs: 70A0EB2B
                                                                                                                                                                                                                            • NULL code object, xrefs: 70A0EA7B
                                                                                                                                                                                                                            • Python interpreter is debug version, xrefs: 70A0E940
                                                                                                                                                                                                                            • The python version in runtime is different from the build time, xrefs: 70A0E8B1
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strlenstrncmp
                                                                                                                                                                                                                            • String ID: <frozen pyarmor>$Check restrict mode of module failed$Check the restrict mode of module failed$Enable restrict mode failed$Got string from code object failed$Incompatible core library$Invalid parameter$Loaded module __main__ not found in sys.modules$Marshal loads failed$NULL code object$Python interpreter is debug version$Restore module failed$The python version in runtime is different from the build time$The runtime library doesn't support Advanced Mode$The runtime library doesn't support Super Mode$This obfuscated script is obfuscated by old PyArmor$ssO|i
                                                                                                                                                                                                                            • API String ID: 1310274236-189690365
                                                                                                                                                                                                                            • Opcode ID: c76b4630db5dba8b94918e888814963c6e56fdf8d1109c16338af8bbd98566b7
                                                                                                                                                                                                                            • Instruction ID: e8202e0a391df97a66eca3d7aa74d733dc9f664c9cb6af039623d3c9ba643694
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c76b4630db5dba8b94918e888814963c6e56fdf8d1109c16338af8bbd98566b7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 20D14E72B09B09D5EB15CF15F88035963B5F799B88F844226D90E87728EF7CE688E341

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2512 70a70c90-70a70ccc 2515 70a70cf2-70a70cfb 2512->2515 2516 70a70cce-70a70cf0 RtlWow64SetThreadContext 2512->2516 2516->2515
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlWow64SetThreadContext.NTDLL ref: 70A70CF0
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ContextThreadWow64
                                                                                                                                                                                                                            • String ID: NtSetInformationThread$ntdll.dll
                                                                                                                                                                                                                            • API String ID: 983334009-3743287242
                                                                                                                                                                                                                            • Opcode ID: 92c065ca89abec1997848133b4d1076c9b5e49955e8ffd3d9a29227274912c27
                                                                                                                                                                                                                            • Instruction ID: 2fc8b2a801552d3e1343ac4fbba029e5866327fdd9809e1ff4e8e36d5b005223
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 92c065ca89abec1997848133b4d1076c9b5e49955e8ffd3d9a29227274912c27
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E8F01535B18A48C9EB609B16FCA074A6360F39CB88F544225DA9D87774EF6CD709CB00

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2518 70a6ffb0-70a7001d call 70a70f40 malloc 2521 70a70023-70a7003f memcpy 2518->2521 2522 70a70bbd 2518->2522 2523 70a70045-70a7005b 2521->2523 2524 70a700e0 2521->2524 2525 70a70bc8-70a70bd6 call 70a96cb8 2522->2525 2527 70a70060-70a7007b 2523->2527 2526 70a700e3-70a70100 2524->2526 2529 70a70081 2527->2529 2530 70a70970-70a70998 call 70a76390 2527->2530 2534 70a70083-70a70086 2529->2534 2535 70a70101-70a70106 2529->2535 2553 70a709a0-70a709b0 call 70a767d0 2530->2553 2537 70a70950-70a70963 call 70a77660 2534->2537 2538 70a7008c 2534->2538 2539 70a70b90-70a70bb8 call 70a76390 2535->2539 2540 70a7010c 2535->2540 2570 70a703d2-70a703d5 2537->2570 2543 70a70092-70a70095 2538->2543 2544 70a70180-70a70183 2538->2544 2539->2522 2545 70a70112-70a70117 2540->2545 2546 70a701e0-70a701e5 2540->2546 2547 70a709b5-70a709e2 call 70a76390 2543->2547 2548 70a7009b 2543->2548 2555 70a70ab0-70a70ad3 call 70a76120 2544->2555 2556 70a70189 2544->2556 2549 70a70b62-70a70b8a call 70a76390 2545->2549 2550 70a7011d 2545->2550 2551 70a70720-70a7073b 2546->2551 2552 70a701eb 2546->2552 2547->2570 2558 70a70383-70a70386 2548->2558 2559 70a700a1-70a700a4 2548->2559 2549->2570 2560 70a70243-70a70248 2550->2560 2561 70a70123-70a70128 2550->2561 2586 70a70745-70a70760 call 70a76ef0 2551->2586 2563 70a702f3-70a702f8 2552->2563 2564 70a701f1-70a701f6 2552->2564 2553->2570 2555->2570 2568 70a702a0-70a702a3 2556->2568 2569 70a7018f-70a70192 2556->2569 2571 70a70690-70a706d2 call 70a77660 call 70a77960 call 70a94120 call 70a75cf0 2558->2571 2572 70a7038c 2558->2572 2559->2553 2573 70a700aa 2559->2573 2580 70a70765-70a70790 call 70a76390 2560->2580 2581 70a7024e 2560->2581 2582 70a707b2-70a707dd call 70a76390 2561->2582 2583 70a7012e 2561->2583 2588 70a70890-70a708a3 2563->2588 2589 70a702fe 2563->2589 2575 70a708d0-70a708eb call 70a76640 2564->2575 2576 70a701fc 2564->2576 2584 70a70a42-70a70a65 call 70a76120 2568->2584 2585 70a702a9 2568->2585 2590 70a70830-70a70853 call 70a76120 2569->2590 2591 70a70198 2569->2591 2570->2527 2579 70a703db 2570->2579 2737 70a706d7-70a706e6 call 70a75ec0 2571->2737 2593 70a70593-70a70596 2572->2593 2594 70a70392-70a70395 2572->2594 2595 70a70520-70a70523 2573->2595 2596 70a700b0-70a700b3 2573->2596 2575->2570 2597 70a704b3-70a704b8 2576->2597 2598 70a70202-70a70207 2576->2598 2579->2524 2580->2570 2601 70a70254-70a70259 2581->2601 2602 70a70470-70a70475 2581->2602 2582->2570 2604 70a70134-70a70139 2583->2604 2605 70a70550-70a70555 2583->2605 2584->2570 2606 70a70433-70a70436 2585->2606 2607 70a702af-70a702b2 2585->2607 2586->2570 2632 70a708b0-70a708cb call 70a766f0 2588->2632 2610 70a70304-70a70309 2589->2610 2611 70a703e0-70a703e5 2589->2611 2590->2570 2613 70a704f0-70a704f3 2591->2613 2614 70a7019e-70a701a1 2591->2614 2593->2525 2631 70a7059c-70a7067f call 70a75b70 call 70a77330 call 70a77a60 * 3 call 70a77490 call 70a78060 call 70a76390 call 70a78060 call 70a76390 call 70a78060 2593->2631 2616 70a70800-70a70821 call 70a76120 2594->2616 2617 70a7039b-70a7039e 2594->2617 2618 70a70b40-70a70b5d call 70a760e0 2595->2618 2619 70a70529-70a7052c 2595->2619 2620 70a70ae0-70a70af4 call 70a7bf10 2596->2620 2621 70a700b9-70a700bc 2596->2621 2597->2632 2644 70a704be-70a704c3 2597->2644 2598->2586 2622 70a7020d-70a70212 2598->2622 2629 70a70920-70a70948 call 70a76390 2601->2629 2630 70a7025f-70a70264 2601->2630 2640 70a708f0-70a7091b call 70a76390 2602->2640 2641 70a7047b-70a70480 2602->2641 2636 70a70a15-70a70a3d call 70a76390 2604->2636 2637 70a7013f-70a70144 2604->2637 2624 70a70860-70a7088b call 70a76390 2605->2624 2625 70a7055b-70a70560 2605->2625 2633 70a70a70-70a70aa4 call 70a76390 2606->2633 2634 70a7043c-70a7043f 2606->2634 2638 70a70b00-70a70b34 call 70a76390 2607->2638 2639 70a702b8-70a702bd 2607->2639 2645 70a706f1-70a70711 2610->2645 2646 70a7030f-70a70314 2610->2646 2627 70a70795-70a707a8 2611->2627 2628 70a703eb-70a703f0 2611->2628 2650 70a707e2-70a707f9 call 70a775c0 2613->2650 2651 70a704f9-70a704fc 2613->2651 2648 70a701a7-70a701aa 2614->2648 2649 70a709f0-70a70a10 call 70a76120 2614->2649 2616->2570 2617->2525 2652 70a703a4-70a703cd call 70a76390 2617->2652 2618->2570 2619->2525 2670 70a70532-70a7054a call 70a7c3e0 2619->2670 2620->2570 2621->2525 2653 70a700c2-70a700dc call 70a7bf10 2621->2653 2622->2525 2672 70a70218-70a7023e call 70a76e80 2622->2672 2624->2570 2625->2525 2673 70a70566-70a7058e call 70a76390 2625->2673 2627->2582 2628->2525 2656 70a703f6-70a70411 2628->2656 2629->2570 2630->2525 2675 70a7026a-70a70295 call 70a76390 2630->2675 2631->2571 2632->2570 2633->2570 2634->2525 2658 70a70445-70a70468 call 70a76120 2634->2658 2636->2570 2637->2525 2660 70a7014a-70a70175 call 70a76390 2637->2660 2638->2570 2639->2525 2678 70a702c3-70a702ee call 70a76390 2639->2678 2640->2570 2641->2525 2662 70a70486-70a704ae call 70a76390 2641->2662 2644->2525 2664 70a704c9-70a704e4 call 70a76630 2644->2664 2661 70a70416-70a70431 call 70a76510 2645->2661 2646->2525 2681 70a7031a-70a70381 call 70a76390 call 70a76510 2646->2681 2648->2525 2666 70a701b0-70a701d3 call 70a76120 2648->2666 2649->2570 2650->2570 2651->2525 2668 70a70502-70a70519 call 70a7b0c0 2651->2668 2652->2570 2653->2527 2727 70a700de 2653->2727 2656->2661 2658->2570 2660->2570 2661->2570 2662->2570 2664->2570 2666->2570 2668->2570 2670->2570 2672->2570 2673->2570 2675->2570 2678->2570 2681->2570 2727->2524 2737->2526 2743 70a706ec 2737->2743 2743->2570
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: mallocmemcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4276657696-0
                                                                                                                                                                                                                            • Opcode ID: 791c4f8927b015886fb24a50f2ab30a87ed52ce1407ff1ffaec066b77c2a18e9
                                                                                                                                                                                                                            • Instruction ID: 3f854b4e0b4bd2c5154bee269f092218abfe356dd434d68adafe375f0becdec5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 791c4f8927b015886fb24a50f2ab30a87ed52ce1407ff1ffaec066b77c2a18e9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E42A131605B58C6EB248B50EC91B6E2724F799B8AF51E236DA4EEB75CCF3CE5048341
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AddressProc$_errno
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$3des$PyArg_ParseTuple$PyBool_FromLong$PyByteArray_AsString$PyBytes_AsString$PyBytes_AsStringAndSize$PyBytes_FromStringAndSize$PyBytes_Size$PyCFunction_Call$PyCFunction_NewEx$PyCell_Set$PyCode_Type$PyDict_Clear$PyDict_Copy$PyDict_GetItemString$PyDict_SetItem$PyDict_SetItemString$PyErr_Clear$PyErr_Fetch$PyErr_Format$PyErr_NoMemory$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyErr_SetString$PyEval_EvalCode$PyEval_EvalFrameEx$PyEval_GetBuiltins$PyEval_GetFrame$PyEval_GetGlobals$PyEval_GetLocals$PyEval_SetProfile$PyEval_SetTrace$PyExc_ImportError$PyExc_RuntimeError$PyFrame_LocalsToFast$PyFrame_Type$PyFunction_Type$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ExecCodeModuleEx$PyImport_GetMagicNumber$PyImport_GetModuleDict$PyImport_ImportModule$PyList_GetItem$PyList_Size$PyLong_AsLong$PyLong_FromLong$PyMarshal_ReadObjectFromString$PyMarshal_WriteObjectToFile$PyMarshal_WriteObjectToString$PyModule_GetDict$PyObject_GetAttrString$PyObject_Print$PyObject_SetAttrString$PyObject_Size$PyObject_Type$PyString_AsStringAndSize$PyString_Format$PyString_FromStringAndSize$PyString_Size$PyString_Type$PySys_GetObject$PySys_SetObject$PyThreadState_Get$PyTuple_GetItem$PyTuple_GetSlice$PyTuple_New$PyTuple_SetItem$PyTuple_Size$PyType_GenericNew$PyUnicodeUCS2_AsUTF8String$PyUnicodeUCS2_Format$PyUnicodeUCS2_FromString$PyUnicodeUCS4_AsUTF8String$PyUnicodeUCS4_Format$PyUnicodeUCS4_FromString$PyUnicode_AsUTF8String$PyUnicode_Fill$PyUnicode_Format$PyUnicode_FromString$PyUnicode_Type$Py_BuildValue$Py_CompileString$Py_CompileStringExFlags$Py_DebugFlag$Py_DecRef$Py_Exit$Py_IncRef$Py_InspectFlag$Py_InteractiveFlag$Py_ReprEnter$_PyEval_EvalFrameDefault$_Py_NoneStruct$_Py_TrueStruct$_pytransform.c$aes$dumps$license.c$license.lic$loads$marshal$pyshield.lic$pytransform.log$sha256$sprng$wrapper.c
                                                                                                                                                                                                                            • API String ID: 1566810575-3086871561
                                                                                                                                                                                                                            • Opcode ID: 3dde89aa4a73aaef531c1cf2d9111f270bae8d1bcb8ac5254fc44e3ed24b5792
                                                                                                                                                                                                                            • Instruction ID: c6d15e650cbbfc270a07c374445c2311c5310b700580a82d554581e20cfc369d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3dde89aa4a73aaef531c1cf2d9111f270bae8d1bcb8ac5254fc44e3ed24b5792
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2FE38EB0B19712E9EB049B11F91079C23A5FB99BC4F844226D94E5B3A8DF3CF646C316

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2149 70a0da10-70a0da30 call 70a05fd0 2152 70a0da80-70a0da8f 2149->2152 2153 70a0da32-70a0da64 call 70a0a7b0 2149->2153 2155 70a0daa0-70a0dab9 call 70a04230 2152->2155 2156 70a0da91-70a0da9b _errno 2152->2156 2157 70a0da69-70a0da6f free 2153->2157 2161 70a0db4c-70a0db7e fprintf 2155->2161 2162 70a0dabf-70a0dac5 _errno 2155->2162 2158 70a0da74-70a0da7e 2156->2158 2157->2158 2165 70a0db1a-70a0db47 fprintf fputc 2161->2165 2163 70a0db80-70a0db9b _errno strerror fprintf 2162->2163 2164 70a0dacb-70a0db13 fprintf * 2 fputc fclose 2162->2164 2163->2164 2164->2165 2165->2156
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 70A05FD0: getenv.MSVCRT ref: 70A06066
                                                                                                                                                                                                                            • _errno.MSVCRT ref: 70A0DA91
                                                                                                                                                                                                                              • Part of subcall function 70A0A7B0: strncmp.MSVCRT ref: 70A0A891
                                                                                                                                                                                                                              • Part of subcall function 70A0A7B0: strchr.MSVCRT ref: 70A0A8A2
                                                                                                                                                                                                                            • free.MSVCRT ref: 70A0DA6F
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errnofreegetenvstrchrstrncmp
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$license.c$license.lic$product.key$pytransform.log
                                                                                                                                                                                                                            • API String ID: 2166687660-2554675036
                                                                                                                                                                                                                            • Opcode ID: 9df7311c4f2525eca8cc3b923d3e1b07d461d20a02d716fe0d9040fd3ecf05e5
                                                                                                                                                                                                                            • Instruction ID: f6921e39fbe2ea8bfa082a9b4ee5395fcf71dbb820493b4c50599c7430b0b608
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9df7311c4f2525eca8cc3b923d3e1b07d461d20a02d716fe0d9040fd3ecf05e5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B31E671B2831699EF019B61F90179D63A1AB89BC4F844226ED4D1B76CEF3CF906C306

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2265 70a04a00-70a04a19 call 70a6ffb0 2268 70a04a25-70a04a62 2265->2268 2269 70a04a1b-70a04a23 2265->2269 2269->2268 2270 70a04a63-70a04a7c call 70a04230 2269->2270 2273 70a04b20-70a04b52 fprintf 2270->2273 2274 70a04a82-70a04a90 _errno 2270->2274 2279 70a04ae8-70a04b18 fprintf fputc 2273->2279 2275 70a04b54-70a04b70 _errno strerror fprintf 2274->2275 2276 70a04a96-70a04ae1 call 70a96ca0 fprintf fputc fclose 2274->2276 2275->2276 2276->2279 2279->2268
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fprintf$fputc$_errnofclosemallocmemcpy
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$protect.c$pytransform.log$!
                                                                                                                                                                                                                            • API String ID: 1944142573-152705595
                                                                                                                                                                                                                            • Opcode ID: f4f11d98654f22f3108b67875ee014831f8f5b40bde045c54f5d2bc865fddc6d
                                                                                                                                                                                                                            • Instruction ID: ce169459db75e4695f2d7c2963c1d399baeddfc44ec2600ce0a200b673199cc4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f4f11d98654f22f3108b67875ee014831f8f5b40bde045c54f5d2bc865fddc6d
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E331B4517182819EEB159B36B950BAD6B70EF86BC8F484165DECD0736AEE2CF403C319

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2283 70a94ed0-70a94ee8 2284 70a94eea-70a94efc 2283->2284 2285 70a94f22-70a94f25 2283->2285 2287 70a95010-70a95012 2284->2287 2288 70a94f02-70a94f04 2284->2288 2286 70a94f27-70a94f39 _errno 2285->2286 2289 70a94f3f-70a94f43 2286->2289 2290 70a94ff0-70a94ff9 _errno 2286->2290 2291 70a95044-70a9504f 2287->2291 2292 70a95014-70a95025 2287->2292 2293 70a94f0a-70a94f12 2288->2293 2294 70a95030-70a95032 2288->2294 2289->2290 2295 70a94f49-70a94f4c 2289->2295 2296 70a94fff-70a9500e 2290->2296 2291->2286 2292->2286 2299 70a94f1d-70a94f20 2293->2299 2300 70a94f14-70a94f1b 2293->2300 2297 70a95088-70a9508d 2294->2297 2298 70a95034-70a9503a 2294->2298 2295->2290 2301 70a94f52-70a94f5d 2295->2301 2298->2291 2299->2286 2300->2286 2300->2299 2302 70a94f63-70a94f91 CreateFileMappingA 2301->2302 2303 70a95054-70a95068 _get_osfhandle 2301->2303 2305 70a94fc8-70a94fea GetLastError _errno 2302->2305 2306 70a94f93-70a94fc6 MapViewOfFile CloseHandle 2302->2306 2303->2302 2304 70a9506e-70a95083 _errno 2303->2304 2304->2296 2306->2296 2306->2305
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: File_errno$CloseCreateErrorHandleLastMappingView
                                                                                                                                                                                                                            • String ID: $@$@
                                                                                                                                                                                                                            • API String ID: 896588047-3743272326
                                                                                                                                                                                                                            • Opcode ID: ad2b5d174cbbaebff85b719ff44f08ee0dbd8e41e6a4b1a3aa829fbda9743842
                                                                                                                                                                                                                            • Instruction ID: cee35e83c8d40c509c7011d4e926b2c1f3f4ee977901ab9e023c1a7fa3cdb22f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad2b5d174cbbaebff85b719ff44f08ee0dbd8e41e6a4b1a3aa829fbda9743842
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2B413473F206608AEB224B16AC00B4D62A5B74DFB5F490326DE7A077D8EB7CD9408344
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: free$strlenstrncmp
                                                                                                                                                                                                                            • String ID: __main__$__mp_main__$__parents_main__$__spec__$frame$obfmode.c
                                                                                                                                                                                                                            • API String ID: 2569063720-2363144754
                                                                                                                                                                                                                            • Opcode ID: ba3fd494e25e941505ccad518361abba6191941cd45df3dbf69a81b8137e310f
                                                                                                                                                                                                                            • Instruction ID: 57daabeed09556e80a5bddd4dce35138cf8524be36cbd361d1afad0cbb098257
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ba3fd494e25e941505ccad518361abba6191941cd45df3dbf69a81b8137e310f
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D432ED72A09608D6EB15CB21FA4036D2766B749B88F404629CD0F4B7ACFB7CE985D701

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2505 70a70de0-70a70e1c GetCurrentThread GetThreadContext 2506 70a70e41 2505->2506 2507 70a70e1e-70a70e24 2505->2507 2509 70a70e49-70a70e89 GetCurrentThread SetThreadContext 2506->2509 2508 70a70e26-70a70e2c 2507->2508 2507->2509 2508->2509 2510 70a70e2e-70a70e34 2508->2510 2510->2509 2511 70a70e36-70a70e3f 2510->2511 2511->2506 2511->2509
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Thread$ContextCurrent
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 195563550-0
                                                                                                                                                                                                                            • Opcode ID: 99d3b8c55569807b5a3df5e2c7eff14ca15bcf6d4e21b9a73be53227edca2030
                                                                                                                                                                                                                            • Instruction ID: 1eddd6dec481bea909cc2e88b09db8f3e19057b72cd79a9069f816696097565b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 99d3b8c55569807b5a3df5e2c7eff14ca15bcf6d4e21b9a73be53227edca2030
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B3112532508744C9EB518B25F918B1EB3E2F788794F509629F6C99669CCFBCC189CB00

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2756 70a96550-70a96558 2757 70a9655a-70a9655e 2756->2757 2758 70a965a3-70a965a9 2756->2758 2760 70a96580 2757->2760 2761 70a96560-70a96564 2757->2761 2759 70a96586-70a9659c VirtualProtect 2758->2759 2764 70a9659e-70a965a2 2759->2764 2760->2759 2762 70a965b0-70a965b6 2761->2762 2763 70a96566-70a9656a 2761->2763 2762->2759 2765 70a9656c-70a96570 2763->2765 2766 70a965d0-70a965d6 2763->2766 2767 70a965c0-70a965c6 2765->2767 2768 70a96572-70a96575 2765->2768 2766->2759 2767->2759 2769 70a965d8-70a965dd 2768->2769 2770 70a96577-70a9657d 2768->2770 2769->2764 2770->2759
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ProtectVirtual
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 544645111-0
                                                                                                                                                                                                                            • Opcode ID: 55520103505fb2b0f5347ec77b52210e5f6cab78dcb607584f853220d99b3cc2
                                                                                                                                                                                                                            • Instruction ID: 718997596fe409d23c43e28f549ccab20ff1ae5dcb4ef59b1ee5d8ebc4f539c1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 55520103505fb2b0f5347ec77b52210e5f6cab78dcb607584f853220d99b3cc2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D9F01CB033603086EB330522C700F6C26E85F06790E7A410A99164EEECE55FC685AF4E

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2771 70a70be0-70a70bec 2772 70a70c10-70a70c21 call 70a77300 2771->2772 2773 70a70bee-70a70bf5 call 70a70db9 2771->2773 2772->2773 2778 70a70bf7-70a70bfe call 70a70dc7 2773->2778 2779 70a70c23-70a70c3c exit 2773->2779 2778->2779 2786 70a70c00 call 70a70de0 2778->2786 2780 70a70c3e-70a70c43 call 70a75710 2779->2780 2781 70a70c4d-70a70c51 2779->2781 2780->2781 2788 70a70c05-70a70c07 2786->2788 2788->2779 2789 70a70c09-70a70c0d 2788->2789
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: feaaaa0cf51caa3f99b8a002e9c14e1708ff5625ace8c5f16572cee7fcd3e753
                                                                                                                                                                                                                            • Instruction ID: cbaeaf6c6e5f43d82b82c2969cc58d8f7f5016185a0d7430ba8a2f7ee5861c2d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: feaaaa0cf51caa3f99b8a002e9c14e1708ff5625ace8c5f16572cee7fcd3e753
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C3F0EC60F06201CEF7156B726E42B1D11A16FAC344F90F538E409C129CE72CF584CB51

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2790 70a94120-70a94136 2791 70a9413c-70a94142 2790->2791 2792 70a94384-70a9438d call 70a7ac80 2790->2792 2793 70a94148-70a94154 2791->2793 2794 70a942f0-70a942f3 2791->2794 2810 70a94397-70a943a3 call 70a949c0 2792->2810 2796 70a942b9-70a942db call 70a94ed0 2793->2796 2797 70a9415a-70a94188 call 70a94eb0 call 70a82d40 2793->2797 2799 70a942f9-70a94300 2794->2799 2800 70a943fb-70a94437 call 70a94ed0 2794->2800 2807 70a942e0-70a942e7 2796->2807 2827 70a9418e 2797->2827 2828 70a94245-70a94251 2797->2828 2804 70a94451-70a9446d call 70a70ec0 2799->2804 2805 70a94306-70a94308 2799->2805 2808 70a9443c-70a9444b 2800->2808 2812 70a9430e-70a94328 2804->2812 2821 70a94473-70a94480 2804->2821 2811 70a943ae-70a943b2 2805->2811 2805->2812 2807->2794 2808->2804 2808->2805 2830 70a943a9 2810->2830 2831 70a9425d-70a9426b call 70a96550 2810->2831 2813 70a943b9-70a943d2 memset 2811->2813 2817 70a943d8-70a943ed call 70a70fe0 2812->2817 2818 70a9432e-70a94333 2812->2818 2813->2817 2813->2818 2826 70a9433d-70a94344 2817->2826 2823 70a94339 2818->2823 2824 70a943f2-70a943f6 2818->2824 2821->2813 2829 70a94486-70a94491 2821->2829 2823->2826 2824->2826 2835 70a9437a 2826->2835 2836 70a94346-70a9434e 2826->2836 2832 70a94190-70a94194 2827->2832 2828->2810 2833 70a94257-70a9425b 2828->2833 2829->2813 2830->2811 2840 70a94270-70a94278 2831->2840 2838 70a9419f-70a941a5 2832->2838 2833->2831 2839 70a94283-70a94298 call 70a70fe0 2833->2839 2835->2792 2837 70a94350-70a94356 2836->2837 2841 70a94358 2837->2841 2842 70a94371-70a94378 2837->2842 2843 70a941ce-70a941d2 2838->2843 2844 70a941a7-70a941ac 2838->2844 2845 70a9429a-70a942a7 call 70a96550 2839->2845 2846 70a9427a-70a94282 2839->2846 2840->2845 2840->2846 2849 70a94360-70a9436f 2841->2849 2842->2835 2842->2837 2843->2846 2852 70a941d8-70a9423f call 70a950a0 call 70a94ed0 call 70a94eb0 call 70a82d40 2843->2852 2844->2838 2851 70a941ae-70a941b6 2844->2851 2854 70a942ac-70a942b8 2845->2854 2849->2842 2849->2849 2855 70a941b8-70a941bf 2851->2855 2856 70a941c1-70a941cc 2851->2856 2852->2828 2852->2832 2855->2838 2855->2856 2856->2843 2856->2844
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memset
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2221118986-0
                                                                                                                                                                                                                            • Opcode ID: ad683bb627b7ab02320f166490d90dff12a04f907f4fe6b01c8a673c6386ec2c
                                                                                                                                                                                                                            • Instruction ID: 8064f0211f80f956083993993018be11ab48410aace7100781154c00130ccf7b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad683bb627b7ab02320f166490d90dff12a04f907f4fe6b01c8a673c6386ec2c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 2F9178B2720B9486DB558F26D04175D3BE5F709FD8F18421AEE8A1B39CDBB8C895C384

                                                                                                                                                                                                                            Control-flow Graph

                                                                                                                                                                                                                            • Executed
                                                                                                                                                                                                                            • Not Executed
                                                                                                                                                                                                                            control_flow_graph 2864 70a70fe0-70a70fee 2865 70a70ff0-70a70ff6 free 2864->2865 2866 70a70ffd-70a71002 2864->2866 2865->2866
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: free
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1294909896-0
                                                                                                                                                                                                                            • Opcode ID: 9287e08c20975ed3c19586d29dd955b81908fc052125fea48543a92b48a8a35e
                                                                                                                                                                                                                            • Instruction ID: 37ad8e1b3b36a6959367083b20d05beb5750edcd6c0f735069558d2b0438d4bb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9287e08c20975ed3c19586d29dd955b81908fc052125fea48543a92b48a8a35e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 43C08CA6A13A00C1FF198BB2FC503383220AF5CF05F189010CE0A463408F2C90D18701
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 70A2282C
                                                                                                                                                                                                                            • CreateFileA.KERNEL32 ref: 70A22860
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32 ref: 70A2287A
                                                                                                                                                                                                                            • DeviceIoControl.KERNEL32 ref: 70A228F4
                                                                                                                                                                                                                            • GlobalFree.KERNEL32 ref: 70A2290A
                                                                                                                                                                                                                            • _snprintf.MSVCRT ref: 70A22947
                                                                                                                                                                                                                            • CreateFileA.KERNEL32 ref: 70A22974
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32 ref: 70A22995
                                                                                                                                                                                                                            • GlobalAlloc.KERNEL32 ref: 70A229A4
                                                                                                                                                                                                                            • DeviceIoControl.KERNEL32 ref: 70A229EC
                                                                                                                                                                                                                            • GlobalFree.KERNEL32 ref: 70A22A05
                                                                                                                                                                                                                            • GlobalFree.KERNEL32 ref: 70A22A0A
                                                                                                                                                                                                                            • CloseHandle.KERNEL32 ref: 70A22A14
                                                                                                                                                                                                                            • GlobalFree.KERNEL32 ref: 70A22A36
                                                                                                                                                                                                                              • Part of subcall function 70A224D0: GetLastError.KERNEL32 ref: 70A224D4
                                                                                                                                                                                                                              • Part of subcall function 70A224D0: FormatMessageA.KERNEL32 ref: 70A22505
                                                                                                                                                                                                                              • Part of subcall function 70A224D0: LocalFree.KERNEL32 ref: 70A22526
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
                                                                                                                                                                                                                            • String ID: /%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d$platforms/windows/hdinfo.c
                                                                                                                                                                                                                            • API String ID: 1119308327-2400754906
                                                                                                                                                                                                                            • Opcode ID: cdc5ca99754b0ed8af1e0c1fc3391b6fed3b1e63f17cefb8642155568022127a
                                                                                                                                                                                                                            • Instruction ID: 78b29783421bd9483aabc46b8ce1290c77c7cf321ccdab8d0dbf543897946013
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cdc5ca99754b0ed8af1e0c1fc3391b6fed3b1e63f17cefb8642155568022127a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FA51E131704A808AE7249F22F914B4B7764F788BE4F444325AE5E4BBD8CF7CC6068704
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
                                                                                                                                                                                                                            • String ID: /%d:$\\.\PhysicalDrive%d
                                                                                                                                                                                                                            • API String ID: 2355516209-72258043
                                                                                                                                                                                                                            • Opcode ID: 30f747ad7a7eb893f58eb9baf259ccbdc94368a5531370d9905ee84ac7e1ee0b
                                                                                                                                                                                                                            • Instruction ID: 0d7b3137eaeb007d479d6924609eaa03627adb4b49fa2c675c148a31f9b832b7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 30f747ad7a7eb893f58eb9baf259ccbdc94368a5531370d9905ee84ac7e1ee0b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 22513672218B8095E701CB22F84475FBBA6BBCA795F444225EE9A47B9DDF7CC508C700
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Cryptclock$Context$Acquire$RandomRelease
                                                                                                                                                                                                                            • String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
                                                                                                                                                                                                                            • API String ID: 2525729555-3762154145
                                                                                                                                                                                                                            • Opcode ID: fc793f130eee9d6fe5856a492ae082c48102eab86eaee6756813012a7edc1188
                                                                                                                                                                                                                            • Instruction ID: a8ec404c47e84b9e32cf0793c61425bd677adc6d0f6f02ad6f5924d66923671b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fc793f130eee9d6fe5856a492ae082c48102eab86eaee6756813012a7edc1188
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F431F232708B4081E711CB66E84475EBAB5B78CBC0F804625DE8A8372CEF7DDA4AC340
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • %02x:%02x:%02x:%02x:%02x:%02x, xrefs: 70A225B7
                                                                                                                                                                                                                            • platforms/windows/hdinfo.c, xrefs: 70A22687
                                                                                                                                                                                                                            • Too small size, xrefs: 70A22680
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heap$Process$AdaptersAddressesFree$Alloc
                                                                                                                                                                                                                            • String ID: %02x:%02x:%02x:%02x:%02x:%02x$Too small size$platforms/windows/hdinfo.c
                                                                                                                                                                                                                            • API String ID: 3314560173-3552495142
                                                                                                                                                                                                                            • Opcode ID: 542046e599156e828d7f4f9cdf4c090b56c29f6628748238c11a617c781fcf51
                                                                                                                                                                                                                            • Instruction ID: adc38e0a36bc108657f6ab604fd605db90014fb713c36f7ad70899483e02aae4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 542046e599156e828d7f4f9cdf4c090b56c29f6628748238c11a617c781fcf51
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3831F6226082919ED710DBBAF910B2E7BA1F789B95F484236BD598379CDF3CD504DB00
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heap$Process$Free$AdaptersAddressesAllocmemcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3510192139-0
                                                                                                                                                                                                                            • Opcode ID: d2da9af87d846cd1c589f1e7d865ef595ba3dcf19010ff1e0370907bd33b5295
                                                                                                                                                                                                                            • Instruction ID: 458859146df9df8e722937a6f6652994330ec62641a27ba8f336e36acaa7ef1c
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d2da9af87d846cd1c589f1e7d865ef595ba3dcf19010ff1e0370907bd33b5295
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8B3104227145919ED701EB6AF900F5E23A6A789BD5F888139EE0E87B18DF38C941C700
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • RtlCaptureContext.KERNEL32 ref: 70A95394
                                                                                                                                                                                                                            • RtlLookupFunctionEntry.KERNEL32 ref: 70A953AB
                                                                                                                                                                                                                            • RtlVirtualUnwind.KERNEL32 ref: 70A953ED
                                                                                                                                                                                                                            • SetUnhandledExceptionFilter.KERNEL32 ref: 70A95431
                                                                                                                                                                                                                            • UnhandledExceptionFilter.KERNEL32 ref: 70A9543E
                                                                                                                                                                                                                            • GetCurrentProcess.KERNEL32 ref: 70A95444
                                                                                                                                                                                                                            • TerminateProcess.KERNEL32 ref: 70A95452
                                                                                                                                                                                                                            • abort.MSVCRT ref: 70A95458
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4278921479-0
                                                                                                                                                                                                                            • Opcode ID: 38f15871d2c854c23405dd6262a20182c3bbfa91e52b680f2e394a1181f99296
                                                                                                                                                                                                                            • Instruction ID: 9fbf7b8e9ebe23eaa7d49609bebf5e78dcff67f58d670e554323d142bdd2cea8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 38f15871d2c854c23405dd6262a20182c3bbfa91e52b680f2e394a1181f99296
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3021F371A19B00D9EB009B65FC9079933A4FB1CB84F54422AD94E97728EF3CE659C704
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: freememcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3223336191-0
                                                                                                                                                                                                                            • Opcode ID: 46af7cd632c3aeae69e4d0033f2a15eb1e727bed9a98cb67f28a53cf6590660a
                                                                                                                                                                                                                            • Instruction ID: e6c9761d233015bb53eb81191f737d25446d12432f865c4322a4ad81bab5a319
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 46af7cd632c3aeae69e4d0033f2a15eb1e727bed9a98cb67f28a53cf6590660a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F451E3727182488AE720DF25F94179EB3A0FB45BD4F584126EE4A97B68EB3CD941CB04
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: freememcpy
                                                                                                                                                                                                                            • String ID: code$obfmode.c
                                                                                                                                                                                                                            • API String ID: 3223336191-930819804
                                                                                                                                                                                                                            • Opcode ID: 065d41aec40e79aac708bcf660ba0800c2a3bb2e898db435c03a11db07326f07
                                                                                                                                                                                                                            • Instruction ID: 6d99e43c4c39d4b7d73b4afd8a3a486c73782635fb562a4f4ca258d941a8b4c3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 065d41aec40e79aac708bcf660ba0800c2a3bb2e898db435c03a11db07326f07
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BAF16B72608B49DAEB11CF25F58035A73B5F789B84F548216DA4E97B6CEB3CE941CB00
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: in != NULL$out != NULL$outlen != NULL$src/misc/base64/base64_decode.c
                                                                                                                                                                                                                            • API String ID: 0-942433653
                                                                                                                                                                                                                            • Opcode ID: a1de569a620ad6ff2f642f603163c984532097288b5ba575777088c551e4dda7
                                                                                                                                                                                                                            • Instruction ID: e60192b28be501d8954a71bf973623ecc9666a3dbc64f14321bf5c3566e74413
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a1de569a620ad6ff2f642f603163c984532097288b5ba575777088c551e4dda7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0192677391C6C887D307CE24A86435E7A22A3D6357F898234EF071B39AE279DE59C351
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: AllocVirtual$InfoSystem
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2622297391-0
                                                                                                                                                                                                                            • Opcode ID: fe55c1f7d03c7a422dae360c7401d7161339d05867d57ba79a64ce01e6a7934a
                                                                                                                                                                                                                            • Instruction ID: 33b6be65b563c75e3afce24196251af1cc13739e1f0d932138555b3f6047f12b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fe55c1f7d03c7a422dae360c7401d7161339d05867d57ba79a64ce01e6a7934a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: FF01A2F0B1650882EF21A722B92975962A26B5CBD9F048B35DE2F5B79CFF2CD1408704
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: aaa936f450e0f3f2617054bbf92e3b1eb155860729415d7dd4d522b3eeb6c5f3
                                                                                                                                                                                                                            • Instruction ID: fd78f73fd857ad01888a3b82d4976e574b0f55c983f5049707155319d51e2956
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aaa936f450e0f3f2617054bbf92e3b1eb155860729415d7dd4d522b3eeb6c5f3
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: ED110A72629240CFE3A09F08E880B1BB6A0E384755F10A125F69ACB7A9D7BCD944CF40
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID:
                                                                                                                                                                                                                            • Opcode ID: 591221a1b99675f22eb83b5d891223287c6b87fad5a8bb23c57e6a131d1777ce
                                                                                                                                                                                                                            • Instruction ID: 115114f5337861c6fd239d043092bc179c1bc58a6644257ec6b0e148e1a7739a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 591221a1b99675f22eb83b5d891223287c6b87fad5a8bb23c57e6a131d1777ce
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 41A00216C4DC10C0D6001B00D981B605128E30A341F1472345139515178B6C92069204
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$fprintfstrerror$fclosefputc$fwrite
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$_pytransform.c$inbuf$pytransform.log
                                                                                                                                                                                                                            • API String ID: 3108438096-3708888661
                                                                                                                                                                                                                            • Opcode ID: a55d836d327e1af174a548d8b552348d7f06c546fdb5a134832f79d2b8d03740
                                                                                                                                                                                                                            • Instruction ID: 8fa3ec4edb807e7096d6f92c165c0945545b6d6b1b146ac59512dc101ca6a1b1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a55d836d327e1af174a548d8b552348d7f06c546fdb5a134832f79d2b8d03740
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CEF19EA0B19755DAEA049B22F91075D23A1BB89BC4F84422ADD0E5B76CEF7CF506C306
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$fprintf$fclosefputc$freefseekmallocstrrchr
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$.pye$__file__$__main__$_pytransform.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 1013380922-457461209
                                                                                                                                                                                                                            • Opcode ID: c066bb9868f66d55eb40aca5f25db856701664b3034599e1a00c4c95f02e15c9
                                                                                                                                                                                                                            • Instruction ID: c214cab25dc08cb896b5134ca0eb39040fb7e6a18611103d7a92f9e82fd673cf
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c066bb9868f66d55eb40aca5f25db856701664b3034599e1a00c4c95f02e15c9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6D18F70B19716DAEA059B16E910B9D2371BB88BC4F844229DD0E5B36CEF7CF946C306
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$fprintf$fclosefputc$freadfreemalloc
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$_pytransform.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 957815278-2792274189
                                                                                                                                                                                                                            • Opcode ID: ad6e7278b6cc92c831a8a70182cb06b6fb80a09ad9da2f50cfd7a7d266822a8a
                                                                                                                                                                                                                            • Instruction ID: 01351576caccf2c462e61d9669d9f1e009ce352a321ab7897783774ddeef12f9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ad6e7278b6cc92c831a8a70182cb06b6fb80a09ad9da2f50cfd7a7d266822a8a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7DC1B2A0719342D9EA059B12EA10BAD2366FB89BC5F84422ADD0E5776CDF3CF546C307
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A231DE
                                                                                                                                                                                                                              • Part of subcall function 70A22E60: strlen.MSVCRT ref: 70A22E83
                                                                                                                                                                                                                            • fprintf.MSVCRT ref: 70A23217
                                                                                                                                                                                                                            • fputc.MSVCRT ref: 70A23249
                                                                                                                                                                                                                              • Part of subcall function 70A22540: GetAdaptersAddresses.IPHLPAPI ref: 70A22571
                                                                                                                                                                                                                              • Part of subcall function 70A22540: GetProcessHeap.KERNEL32 ref: 70A225ED
                                                                                                                                                                                                                              • Part of subcall function 70A22540: HeapFree.KERNEL32 ref: 70A225F7
                                                                                                                                                                                                                            • fprintf.MSVCRT ref: 70A23278
                                                                                                                                                                                                                              • Part of subcall function 70A22360: GetProcessHeap.KERNEL32 ref: 70A223B3
                                                                                                                                                                                                                              • Part of subcall function 70A22360: HeapFree.KERNEL32 ref: 70A223BD
                                                                                                                                                                                                                            • fputc.MSVCRT ref: 70A232AB
                                                                                                                                                                                                                              • Part of subcall function 70A226B0: GetAdaptersAddresses.IPHLPAPI ref: 70A226E4
                                                                                                                                                                                                                              • Part of subcall function 70A226B0: inet_ntoa.WS2_32 ref: 70A22725
                                                                                                                                                                                                                              • Part of subcall function 70A226B0: GetProcessHeap.KERNEL32 ref: 70A22740
                                                                                                                                                                                                                              • Part of subcall function 70A226B0: HeapFree.KERNEL32 ref: 70A2274A
                                                                                                                                                                                                                            • fprintf.MSVCRT ref: 70A232DA
                                                                                                                                                                                                                            • fputc.MSVCRT ref: 70A232EE
                                                                                                                                                                                                                              • Part of subcall function 70A22A90: GetProcessHeap.KERNEL32 ref: 70A22AAB
                                                                                                                                                                                                                              • Part of subcall function 70A22A90: HeapAlloc.KERNEL32 ref: 70A22ABF
                                                                                                                                                                                                                              • Part of subcall function 70A22A90: GetNetworkParams.IPHLPAPI ref: 70A22AF7
                                                                                                                                                                                                                              • Part of subcall function 70A22A90: GetProcessHeap.KERNEL32 ref: 70A22B19
                                                                                                                                                                                                                              • Part of subcall function 70A22A90: HeapFree.KERNEL32 ref: 70A22B23
                                                                                                                                                                                                                            • fprintf.MSVCRT ref: 70A2331D
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A2333E
                                                                                                                                                                                                                            • strchr.MSVCRT ref: 70A2336B
                                                                                                                                                                                                                            • fputc.MSVCRT ref: 70A23382
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A233A3
                                                                                                                                                                                                                            • fprintf.MSVCRT ref: 70A233CB
                                                                                                                                                                                                                            • strchr.MSVCRT ref: 70A233D8
                                                                                                                                                                                                                            • fprintf.MSVCRT ref: 70A233F9
                                                                                                                                                                                                                            • fputc.MSVCRT ref: 70A23412
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A23433
                                                                                                                                                                                                                            • malloc.MSVCRT ref: 70A2343D
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A237D7
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A237F8
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A23819
                                                                                                                                                                                                                            • fwrite.MSVCRT ref: 70A2383A
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • "%s", xrefs: 70A233AD, 70A233EC
                                                                                                                                                                                                                            • Default Mac address: "%s", xrefs: 70A2326B
                                                                                                                                                                                                                            • Serial number with disk name: , xrefs: 70A2338E
                                                                                                                                                                                                                            • Failed to get ip address., xrefs: 70A23804
                                                                                                                                                                                                                            • >", xrefs: 70A23797
                                                                                                                                                                                                                            • Ip address: "%s", xrefs: 70A232CD
                                                                                                                                                                                                                            • %02x, xrefs: 70A2374D
                                                                                                                                                                                                                            • Hardware informations got by PyArmor:, xrefs: 70A231C6
                                                                                                                                                                                                                            • Failed to get harddisk information., xrefs: 70A237C2
                                                                                                                                                                                                                            • %02x:, xrefs: 70A236EE
                                                                                                                                                                                                                            • Serial number of default harddisk: "%s", xrefs: 70A2320A
                                                                                                                                                                                                                            • Multiple Mac addresses: "<, xrefs: 70A2341E
                                                                                                                                                                                                                            • Failed to get mac address., xrefs: 70A237E3
                                                                                                                                                                                                                            • Domain name: "%s", xrefs: 70A23310
                                                                                                                                                                                                                            • Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 70A23329
                                                                                                                                                                                                                            • Failed to get domain name., xrefs: 70A23825
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heap$fwrite$fprintf$Processfputc$Free$AdaptersAddressesstrchr$AllocNetworkParamsinet_ntoamallocstrlen
                                                                                                                                                                                                                            • String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
                                                                                                                                                                                                                            • API String ID: 558248371-3771683696
                                                                                                                                                                                                                            • Opcode ID: aba8da94125094eb1bc20d54423bfc0d0eff60338e23d32f655396aa6ee7df3c
                                                                                                                                                                                                                            • Instruction ID: ab2814ce4649bb32a0d5ad94461592e4eab04a3b78948e03f1eb92a38bb1a70f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aba8da94125094eb1bc20d54423bfc0d0eff60338e23d32f655396aa6ee7df3c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3402DD72705B808ADB50CB26F54539E77A5EB8AB90F008229EF9E4B798DF3CD144C705
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fprintf$_errno$strerror$fputc$fclose$_time64atoffreestrlenstrstr
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$*TIME:$license.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 3204063161-4277730492
                                                                                                                                                                                                                            • Opcode ID: cb050303a69b0c0ede515df855fc2f32b7e6e906ea1da2ffe09435c3ab5b4562
                                                                                                                                                                                                                            • Instruction ID: 2126cfc1af72039f5c50a19794cc0658df879707cefd90488eb4f3660fde2bba
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: cb050303a69b0c0ede515df855fc2f32b7e6e906ea1da2ffe09435c3ab5b4562
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: D181E360B19742D9EB069B21E91075D23B6BB89BD4F444226D90E5B3A8EF3CF546C306
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errnomalloc
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$j > 0$protect.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 2517923351-3883256839
                                                                                                                                                                                                                            • Opcode ID: d98f6a1d45c40412b89ddfe07c0ad1096fc9d0541695713904ccfbe0a1f1c3d5
                                                                                                                                                                                                                            • Instruction ID: ff07d6d3b3f9b6b98854da9fc516575f118b90ff98d56f831fa1d945c1adf2f5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d98f6a1d45c40412b89ddfe07c0ad1096fc9d0541695713904ccfbe0a1f1c3d5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6881F7607197129ADB059B22E950B5D3361BB89BC4F844139ED4D8B36CEF7CF542C316
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$freemalloc
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$key != NULL$protect.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 1860011666-3885171557
                                                                                                                                                                                                                            • Opcode ID: 4b62609a4b1903dd6d89b481359b4e88695e8dbb520c5cfd4a6d6e009cf23c02
                                                                                                                                                                                                                            • Instruction ID: 509ea94fd3a3a3b0b0f5887046d1078b872c9f92159d09f6358ee19bded4a022
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4b62609a4b1903dd6d89b481359b4e88695e8dbb520c5cfd4a6d6e009cf23c02
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4371C060719705D9EB059B22FE1076D23A6BB99BC4F84413AAD0E5B36CEF3CF5058326
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$freemallocstrerror
                                                                                                                                                                                                                            • String ID: (OOO)$+F7unNMN$04U5w91r$3fvNMf9L$41qM08fu$4mLks8EO$Ew==$HERhc2hp$IFB5c2hp$IoHvpCe3$RbgIUXyw$S8tSMMR7$UeQH2iY/$Wrap result failed$Xa2Z/Fdw$ZWxkIFBy$aGQGvX/a$b2plY3Ql$bmdzb2Z0$cDxn1XUJ$ej7tPRL6$fSis3Gx0$k6W630PQ$nc/WZrlr$oFj2UIkE$oVCzhcbp$p5dyeOAr$qNGCrKem$thDV3x4e
                                                                                                                                                                                                                            • API String ID: 2349789213-1418605665
                                                                                                                                                                                                                            • Opcode ID: a81d314495ee4243677574dbba431481c417bf6845a628fe2e98c0ece042ae14
                                                                                                                                                                                                                            • Instruction ID: 78d8931315209e5107b875b6d3043ef45e632cbbc8eb1df4609bbf268d1bd2f7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a81d314495ee4243677574dbba431481c417bf6845a628fe2e98c0ece042ae14
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9DB14976605B8889DBA4CF26B84074E77E9F788B84F54812ACF8D9BB18DF38D561C740
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errnofprintf$fputc$fclose
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$_pytransform.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 1597153534-2792274189
                                                                                                                                                                                                                            • Opcode ID: 965f4bcb16246e92763e2d81b5dff386b5e097a7ed16ec24f2d3a33b0c55399c
                                                                                                                                                                                                                            • Instruction ID: 1bb4ec97db281722209b1fc787afb349fad2dbd8202ebf2bd55b624b51c9fa52
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 965f4bcb16246e92763e2d81b5dff386b5e097a7ed16ec24f2d3a33b0c55399c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E919B60B19712E6EA05DB12E910B5D2375BB88BC4F845229ED0E5B36CDF3CFA468306
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fprintf$_errno$fputc$fclose$strerror
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$(O)$pytransform.log$wrapper.c
                                                                                                                                                                                                                            • API String ID: 1803879104-71371975
                                                                                                                                                                                                                            • Opcode ID: 912dc521261d1d4f2b0080924e4c6082783260cfc3a337a1380329dcac03b09c
                                                                                                                                                                                                                            • Instruction ID: 805acb5b26305301531e3a2d65506f471216a2fdce9a8898db0420f220212266
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 912dc521261d1d4f2b0080924e4c6082783260cfc3a337a1380329dcac03b09c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B47192A0B19745E9EF049B22FA14B5D2362BB99BC5F40422ADD0E1B368EF7CF505C316
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$free$mallocstrerrorstrlen$fclosefseek
                                                                                                                                                                                                                            • String ID: Decode trial license failed$Format trial license file '%s'$Get current time failed$Invalid trial license file, size is %d != 256$Read trial license file '%s'$license.lic
                                                                                                                                                                                                                            • API String ID: 1618752535-3017380149
                                                                                                                                                                                                                            • Opcode ID: d7c0a06e2088ff87d699dcf1e97d3b1e07410f3da7d4ce0c67dd83239d24a611
                                                                                                                                                                                                                            • Instruction ID: 930a3c6776f156c1877515d5279a18ea7cf30e822b77bede63db8e56cd96778a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: d7c0a06e2088ff87d699dcf1e97d3b1e07410f3da7d4ce0c67dd83239d24a611
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 88711371708646DADB01CB24F9117AD63B2FB88784F944225EA4E43BACEF7CE585C711
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fprintf$_errno$fputc$fclosestrerror
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$(O)$pytransform.log$wrapper.c
                                                                                                                                                                                                                            • API String ID: 775964473-71371975
                                                                                                                                                                                                                            • Opcode ID: e18e1272c58465955a0fb1316aa0f123a6dc247921916cb65b3e378ff617b6cb
                                                                                                                                                                                                                            • Instruction ID: 443e8e53f564d145d799b1cf557eab261b3f419400f85a98dd2c72952ad08cc2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e18e1272c58465955a0fb1316aa0f123a6dc247921916cb65b3e378ff617b6cb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4E5171A0719705E9EF049B52FA1476D23A6BB98BC5F40422ADD4D1B368EF7CF506C312
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$strerrorstrlen
                                                                                                                                                                                                                            • String ID: %c%c%c%s$%c%s$%s%s$Could not generate license in trial version$Dashingsoft Pyshield Project$Encode buffer failed$Import rsa key failed$Sign hash failed$The size of serial number %d > 2048$The total size of serial number %d > 2560
                                                                                                                                                                                                                            • API String ID: 427076510-1296519401
                                                                                                                                                                                                                            • Opcode ID: c329fe3827fef54b7b123c9e03f55592b3520a4cbf69281bef8f24e96dc3b429
                                                                                                                                                                                                                            • Instruction ID: 416187afce5d70c449ab116920cb23c18104a06d9d5715d4986e0b5d9e8f8a87
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c329fe3827fef54b7b123c9e03f55592b3520a4cbf69281bef8f24e96dc3b429
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 23C16F72608B8596D720DF11F95078EB3A5F788784F944126EA8E83B6CEF3CD545CB40
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$fclosefreadstrerror
                                                                                                                                                                                                                            • String ID: Encode moudle key failed$Invalid public key %s$Open public key %s failed$Wrap result failed$Write output %s failed
                                                                                                                                                                                                                            • API String ID: 1423157237-2416068227
                                                                                                                                                                                                                            • Opcode ID: 7634e982195c3ce0e30b54324265de6709b3784b91dd99167d1b05229abd0637
                                                                                                                                                                                                                            • Instruction ID: 33515db0b70ae701f86a07a38838bd38b59afe21dddc52d46ba282719d696971
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7634e982195c3ce0e30b54324265de6709b3784b91dd99167d1b05229abd0637
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0F51DF22B15746A5EA01DF52F91079E23A4FB89BC4F840126EE4E5776CEF3CE686C341
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                              • Part of subcall function 70A04900: fseek.MSVCRT ref: 70A04954
                                                                                                                                                                                                                              • Part of subcall function 70A04900: malloc.MSVCRT ref: 70A0496E
                                                                                                                                                                                                                              • Part of subcall function 70A04900: fclose.MSVCRT ref: 70A049A3
                                                                                                                                                                                                                            • _errno.MSVCRT ref: 70A0EC60
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errnofclosefseekmalloc
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$pytransform.log$utils.c
                                                                                                                                                                                                                            • API String ID: 882899668-4272501623
                                                                                                                                                                                                                            • Opcode ID: 00ab74ad02e025a31693e3314fb5883291eceee1359ff899981b4beb1bdb1360
                                                                                                                                                                                                                            • Instruction ID: 7ff95dd6d7ef1c57135f4a5d2a50e3532d06407c11647e499c4f9fe7a73093cc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00ab74ad02e025a31693e3314fb5883291eceee1359ff899981b4beb1bdb1360
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6441C361715209E9FA01DB52FE50BAD23A1BF98BC4F84422A9D0D573A8EF3CF505C305
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _strdup$fclosefprintf
                                                                                                                                                                                                                            • String ID: __armor%s__$__armor__$__armor_enter%s__$__armor_enter__$__armor_exit%s__$__armor_exit__$__armor_wrap%s__$__armor_wrap__$__pyarmor%s__$__pyarmor__$little$pytransform.log
                                                                                                                                                                                                                            • API String ID: 2840409039-221964360
                                                                                                                                                                                                                            • Opcode ID: 8df971dc2556e92d7f00076b5f4740f1aa481678c7a4da0365175499cdd3e438
                                                                                                                                                                                                                            • Instruction ID: f15c05001ba333f1b7e9291657e74d480686af157944bf12f0423a5bcc00a5cb
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8df971dc2556e92d7f00076b5f4740f1aa481678c7a4da0365175499cdd3e438
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8451E261B19702E9FB118B61ED907992365BB487D8F84413ADD0E873A8DB3CF986C352
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • This function is not included in trial version, xrefs: 70A13F2E
                                                                                                                                                                                                                            • %.0f, xrefs: 70A14090
                                                                                                                                                                                                                            • Failed to encode trial license., xrefs: 70A14180
                                                                                                                                                                                                                            • Fail to write trial license file %s, xrefs: 70A13FA1
                                                                                                                                                                                                                            • key/iv size is %d, it must be 32., xrefs: 70A1402A
                                                                                                                                                                                                                            • %s is not a legal public key, xrefs: 70A13ED2
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: free$_errno_time64fclosefreadmallocstrlen
                                                                                                                                                                                                                            • String ID: %.0f$%s is not a legal public key$Fail to write trial license file %s$Failed to encode trial license.$This function is not included in trial version$key/iv size is %d, it must be 32.
                                                                                                                                                                                                                            • API String ID: 710462250-180510518
                                                                                                                                                                                                                            • Opcode ID: 8dffddcdf73824a77776eda5a98c0eecbbf8ba2c98618d7aa9cbb167c4670eb9
                                                                                                                                                                                                                            • Instruction ID: 964df151b8e8e220bf49e089259e60b8dd644538b9e4ba386c7f9c7078909683
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8dffddcdf73824a77776eda5a98c0eecbbf8ba2c98618d7aa9cbb167c4670eb9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: EF612821B1574699DB11DB25E90179E63B4FB89B84F844222EE4E47B6CEF3CE586C300
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno$fprintf$fclosestrerror
                                                                                                                                                                                                                            • String ID: %s$%s,%d,%s$pytransform.log
                                                                                                                                                                                                                            • API String ID: 190382524-2823618119
                                                                                                                                                                                                                            • Opcode ID: 93a5a0c07d549ce71ee43f4bc77aef7159f97b429231196b3d5bb4582a56cfb0
                                                                                                                                                                                                                            • Instruction ID: d19d642611ce647108502ef8c731c564c91e78096b704cae0a38ee823b592ef2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 93a5a0c07d549ce71ee43f4bc77aef7159f97b429231196b3d5bb4582a56cfb0
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CC319F6171560299EA14AF12FD50F6C33A1BB89BC4F948139ED0D9B368DF6CF904C705
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: free$malloc$memcpy$memset
                                                                                                                                                                                                                            • String ID: msghash != NULL$out != NULL$outlen != NULL$src/pk/pkcs1/pkcs_1_pss_encode.c
                                                                                                                                                                                                                            • API String ID: 4204908464-4182795421
                                                                                                                                                                                                                            • Opcode ID: 394a0cc08b71c71b711017a63d303393fe331e9e8468e4ddcf9396b1b1428d88
                                                                                                                                                                                                                            • Instruction ID: bc8ee3992a74ba7107c35ab1353fcb23de458d038c3bba864d6b844b455ae4b1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 394a0cc08b71c71b711017a63d303393fe331e9e8468e4ddcf9396b1b1428d88
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: BB91C07231868486DB61CB56E85576EF7A4F78ABC4F80411AEE8B97B2CDF38D445CB00
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fprintf$_errno$fputc$fclosestrerror
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$(iii)$_pytransform.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 775964473-1072082768
                                                                                                                                                                                                                            • Opcode ID: 70661684ba1b26f9ab01d0a1dc81501ee04e80534cb4dd379aabe13916287f6b
                                                                                                                                                                                                                            • Instruction ID: 5be3b13954aa4861e7396b24ac19b2420183732b2b47dc4903de0db726178dbc
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 70661684ba1b26f9ab01d0a1dc81501ee04e80534cb4dd379aabe13916287f6b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 44316D60B29611A5EB049B25F911BA923A1BB98BC5F8442369D0D1B3A8DF3CF506C715
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _errno
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$_pytransform.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 2918714741-2792274189
                                                                                                                                                                                                                            • Opcode ID: da910fc67629ffbd093e54d7988a5d23c43f9099cce52fa61df74b39babf3782
                                                                                                                                                                                                                            • Instruction ID: d101ad0d357833b7a55e9eb0dd126358c979390e200278e919f04a2ee92782be
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: da910fc67629ffbd093e54d7988a5d23c43f9099cce52fa61df74b39babf3782
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E7418A61B1875596EB01DB12F84075D6775FB98BC4F804226EE8D07768EF3CE946C702
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fprintf$_errno$fputc$fclosefreestrerror
                                                                                                                                                                                                                            • String ID: %s$%s,%d,0x%x,$license.c$pytransform.log
                                                                                                                                                                                                                            • API String ID: 1153345444-4157288542
                                                                                                                                                                                                                            • Opcode ID: ffc7b84cf68f5d6564801d4922fabe33b1b8921e3d97d9bc228ab911f2538b19
                                                                                                                                                                                                                            • Instruction ID: 59b2ad19078fdce73386e30f8942dac979d3965d47049c73e007880d6cfea187
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: ffc7b84cf68f5d6564801d4922fabe33b1b8921e3d97d9bc228ab911f2538b19
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 52319160719702DAEE059B22EA1175D2365BB88BC4F44422ADD0D4B7ACEF3CF545C312
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: FileMessageModuleName_snwprintfmalloc
                                                                                                                                                                                                                            • String ID: %ws$<unknown>$Assertion failed!Program: %wsFile: %ws, Line %uExpression: %ws$MinGW Runtime Assertion$j > 0$protect.c
                                                                                                                                                                                                                            • API String ID: 2604804178-2804858100
                                                                                                                                                                                                                            • Opcode ID: 0c98c8e727a6f753afaa3e636ce7d2923a9dbc9a68d3f2aed557cb5397344333
                                                                                                                                                                                                                            • Instruction ID: 5787a52ffbc75a8637399529ff8c9b8e70a65f880686d386e60bd3ad021811dd
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0c98c8e727a6f753afaa3e636ce7d2923a9dbc9a68d3f2aed557cb5397344333
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B721F13172961488EB019B11EA613AD22F9BF4CBC0F844139E94E573A8EF3CE641C388
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy$calloc$qsort
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3784193592-0
                                                                                                                                                                                                                            • Opcode ID: f8a31cafca17b49ee865ec96ecabbef01e02ee2e601e42f78c4370a9c30451e9
                                                                                                                                                                                                                            • Instruction ID: a8ec1e3f234de6d6990665c818d5027dc79e2da4feb304e1080aec3cd94cc6ec
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: f8a31cafca17b49ee865ec96ecabbef01e02ee2e601e42f78c4370a9c30451e9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9AD134B2B152A08BC706CF11DC55A9EFBA6F74AB89FC64415EE470B308DB79E985C700
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: callocfree
                                                                                                                                                                                                                            • String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
                                                                                                                                                                                                                            • API String ID: 306872129-190324370
                                                                                                                                                                                                                            • Opcode ID: 00032ed3db1f93e09bf8e792e5165cac446416ec25721daf67e8b95a1aeb4938
                                                                                                                                                                                                                            • Instruction ID: 9984e4fd40495c354f216ec38a63e9e0e38cfc1ee22220bd7bb7dd72a4154ef6
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 00032ed3db1f93e09bf8e792e5165cac446416ec25721daf67e8b95a1aeb4938
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 49C19932608A81CADB60DF62E91479EA765F7C8BD6F414036EE8E97718EF78D844C740
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: free$memcmp$malloc
                                                                                                                                                                                                                            • String ID: hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
                                                                                                                                                                                                                            • API String ID: 2896619906-237625700
                                                                                                                                                                                                                            • Opcode ID: 6ffeda7cc8a55cbcf888c16a24e0d04617079490293b1f1c0bad2095a7be1b9a
                                                                                                                                                                                                                            • Instruction ID: 9f772e92b6d4e25c7928f97a1c5bce61baa1eefe74c7ef371a86ec995fe98713
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 6ffeda7cc8a55cbcf888c16a24e0d04617079490293b1f1c0bad2095a7be1b9a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: DBB18C722086848AD720CF51E54479EF7A5F389BC8F904229EE8A5BB1CDB7DE945CB40
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: in != NULL$key != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_free.c$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
                                                                                                                                                                                                                            • API String ID: 0-606996012
                                                                                                                                                                                                                            • Opcode ID: 3436153c26d65bd5f30bc5d903f126740ae23a3eceedabc0958ce7f7c1c03c28
                                                                                                                                                                                                                            • Instruction ID: 286936b4738a7848b0615287925369aca64c1aa5b2c3a288379e50c106d8443a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3436153c26d65bd5f30bc5d903f126740ae23a3eceedabc0958ce7f7c1c03c28
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: B1221972208B85C6E760CF22E45478EB7A4F788B98F504126EE8E87B5CDF79D585CB40
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • VirtualProtect.KERNEL32(?,?,?,?,?,?,70A01278), ref: 70A9588D
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Unknown pseudo relocation protocol version %d., xrefs: 70A95A0E
                                                                                                                                                                                                                            • Unknown pseudo relocation bit size %d., xrefs: 70A959FA
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ProtectVirtual
                                                                                                                                                                                                                            • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                                                                                                                                                                            • API String ID: 544645111-395989641
                                                                                                                                                                                                                            • Opcode ID: 67276921af4edec6daa396d0bc490a36be5ef5f29907ee46fc5e4460ccf124c5
                                                                                                                                                                                                                            • Instruction ID: c83cbbca61abc0343ffc357c7b21320b78f2b36ac401b92930a9324d27570f9a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 67276921af4edec6daa396d0bc490a36be5ef5f29907ee46fc5e4460ccf124c5
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1B91F631B302548AEF158775D98274D63E2BB4D7A4F948619CE1E877ACEA3DD981C30C
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strcmp
                                                                                                                                                                                                                            • String ID: 3des$name != NULL$src/misc/crypt/crypt_find_hash.c
                                                                                                                                                                                                                            • API String ID: 1004003707-2898822856
                                                                                                                                                                                                                            • Opcode ID: 17bda9a5e38040ede557d212e29a991edcc59bbe9c69e27a0e2e80992a905be9
                                                                                                                                                                                                                            • Instruction ID: 1479c84d9f0e53a92b50dbddb3bc64bdaab9f095d159dea93e6e426f8b3a5c1d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 17bda9a5e38040ede557d212e29a991edcc59bbe9c69e27a0e2e80992a905be9
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 6731666335228649DF15DA62A7A47BD6361FF88BC6F004139ED1F8F959EF18E509C310
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heap$Process$AdaptersAddressesFree$Allocinet_ntoa
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1708681428-0
                                                                                                                                                                                                                            • Opcode ID: b98aee25327f76b748025f518f80e528aeb961a8c75e6496a976b9377e69ce13
                                                                                                                                                                                                                            • Instruction ID: c3daa0c0a45f5abd77befb96f94072ea2ede413f78865f5b60c1b89ef6072f75
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b98aee25327f76b748025f518f80e528aeb961a8c75e6496a976b9377e69ce13
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1021D3217186509AD7049BA6FD11B1E62A6BBCDB95F088235AD0D577A8DF38E5418B00
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Heap$Process$Free$Alloc$NetworkParams
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3483679945-0
                                                                                                                                                                                                                            • Opcode ID: 76efa96e1acd114793a94f8b7d214b5392da9615bece9c3d993956f0684706fd
                                                                                                                                                                                                                            • Instruction ID: f001f7b95b3045b3e0a64c44733ca262071fd889bcad5d2c2ea1eb7a63568a38
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 76efa96e1acd114793a94f8b7d214b5392da9615bece9c3d993956f0684706fd
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A311571170160568DA14EBB3BD00B6E97922FCEBD5F488236AD2D973ACEE3CE5428310
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strrchr
                                                                                                                                                                                                                            • String ID: <frozen %s$__init__.py
                                                                                                                                                                                                                            • API String ID: 3418686817-1237021342
                                                                                                                                                                                                                            • Opcode ID: bbc7994d83aee2c31e706521893ec7228d2d1d535aed39df0037f7a74b32eceb
                                                                                                                                                                                                                            • Instruction ID: 872b417d666911d851596a35b7c82b46761c69ce0f78d2813fb695a20d09c74e
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: bbc7994d83aee2c31e706521893ec7228d2d1d535aed39df0037f7a74b32eceb
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E0512A123056955AEF118F26E5007AD6771B789FC8F884425EE4E1778CFB7CD686C314
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: signal
                                                                                                                                                                                                                            • String ID: CCG
                                                                                                                                                                                                                            • API String ID: 1946981877-1584390748
                                                                                                                                                                                                                            • Opcode ID: 1d0cb62066153b77727612b7b50d8dcb26671ddbe4a430b0e696f3b5fff60354
                                                                                                                                                                                                                            • Instruction ID: 47fed1c9436f48ea1437853e556a1def360e88535748a9ef0533c580238d3028
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 1d0cb62066153b77727612b7b50d8dcb26671ddbe4a430b0e696f3b5fff60354
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 12314F307315044AFF5992B9456632D11E69B8E338F258629DA2BCB3FCED199DC0031E
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • src/misc/crypt/crypt_register_hash.c, xrefs: 70A2DCA7
                                                                                                                                                                                                                            • hash != NULL, xrefs: 70A2DCAE
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcmp
                                                                                                                                                                                                                            • String ID: hash != NULL$src/misc/crypt/crypt_register_hash.c
                                                                                                                                                                                                                            • API String ID: 1475443563-1465673959
                                                                                                                                                                                                                            • Opcode ID: 260e42ce48444bb2bd22005100616deab472049bb68104e6cd1f3f5cbce349f2
                                                                                                                                                                                                                            • Instruction ID: 7cc980dc135ddb0b3a46b706f71e90c7739df354b158d60b3276b08ce6fafcc0
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 260e42ce48444bb2bd22005100616deab472049bb68104e6cd1f3f5cbce349f2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4061AE3330075486D714CB26E994B9E73A8F748BD8F118029DF8A87B68DF39E95AC354
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • src/misc/crypt/crypt_register_prng.c, xrefs: 70A2DEFF
                                                                                                                                                                                                                            • prng != NULL, xrefs: 70A2DF06
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcmp
                                                                                                                                                                                                                            • String ID: prng != NULL$src/misc/crypt/crypt_register_prng.c
                                                                                                                                                                                                                            • API String ID: 1475443563-58737364
                                                                                                                                                                                                                            • Opcode ID: 459dcdc2fa02f87d4296b62e1ea01cad54d5515d110e42ce3730b2095f469880
                                                                                                                                                                                                                            • Instruction ID: ec431e3f3a1f1c50b9758e5dda9c6ae3d57e5d08c281df82ef9f5edcf64f1df5
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 459dcdc2fa02f87d4296b62e1ea01cad54d5515d110e42ce3730b2095f469880
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9D518D33340A949AD710CF12EA84B9E7369FB98BC5F424039DF5A8B654EB38E549C710
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strcmp
                                                                                                                                                                                                                            • String ID: name != NULL$src/misc/crypt/crypt_find_prng.c
                                                                                                                                                                                                                            • API String ID: 1004003707-2030105502
                                                                                                                                                                                                                            • Opcode ID: b2abfc6059d250dcdbdd5cb5cf3954ec282682f8af4ef2a9d8e4da86dc26cfe8
                                                                                                                                                                                                                            • Instruction ID: d0371638aeb6a0958fd36a2c3fb3ab8718aea3d798e29509e3ec2371ee7f08c4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b2abfc6059d250dcdbdd5cb5cf3954ec282682f8af4ef2a9d8e4da86dc26cfe8
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3E31956734268689DE15DB62A7E43BD6361EF89BC6F0041389E0B8F94DEB18E506C350
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • name != NULL, xrefs: 70A2D5A8
                                                                                                                                                                                                                            • src/misc/crypt/crypt_find_cipher.c, xrefs: 70A2D5A1
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strcmp
                                                                                                                                                                                                                            • String ID: name != NULL$src/misc/crypt/crypt_find_cipher.c
                                                                                                                                                                                                                            • API String ID: 1004003707-679692990
                                                                                                                                                                                                                            • Opcode ID: 38309888a37da56a2906ed14cd3bc46d000e856524f8997045342d775a3ee526
                                                                                                                                                                                                                            • Instruction ID: 57d97bd02e617bb078ea4ea57e64aa04c7a6596b90a23db098b8c4c37301e0e3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 38309888a37da56a2906ed14cd3bc46d000e856524f8997045342d775a3ee526
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1131B76334218649EF14DA52ABE07FD6361EFC87CAF0045389E0B8F94DEB24E905C354
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: malloc
                                                                                                                                                                                                                            • String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
                                                                                                                                                                                                                            • API String ID: 2803490479-2931318352
                                                                                                                                                                                                                            • Opcode ID: b15cb278836e05de0692a5a7f527248ce66e7c3a485f02b4fe1421511b573008
                                                                                                                                                                                                                            • Instruction ID: 62f09c8fb4ba796de6f823f5abf0b2a5c0274718124e9232830b081ee4fba419
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b15cb278836e05de0692a5a7f527248ce66e7c3a485f02b4fe1421511b573008
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 065136337092944ADB26CB32AD0476EEF62EB49BC4F984118DE574BA0CEB39E905C700
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • code, xrefs: 70A07457
                                                                                                                                                                                                                            • The function '%s' could not be obufscated with advanced mode 2, insert one redundant line '[None, None]' at the beginning of this function to fix it, xrefs: 70A072FA
                                                                                                                                                                                                                            • lambda_, xrefs: 70A06E13
                                                                                                                                                                                                                            • <lambda>, xrefs: 70A06DF0
                                                                                                                                                                                                                            • obfmode.c, xrefs: 70A07450
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy
                                                                                                                                                                                                                            • String ID: <lambda>$The function '%s' could not be obufscated with advanced mode 2, insert one redundant line '[None, None]' at the beginning of this function to fix it$code$lambda_$obfmode.c
                                                                                                                                                                                                                            • API String ID: 3510742995-709486575
                                                                                                                                                                                                                            • Opcode ID: 503032d764b40375dc8c4a7543e0c4219453fae51b0f939bca72a95dd7092d79
                                                                                                                                                                                                                            • Instruction ID: 944573f31036e29d6e57291945717955bfa8a8e2e84d8052f6551d7903a13771
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 503032d764b40375dc8c4a7543e0c4219453fae51b0f939bca72a95dd7092d79
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F812C372F08A84C6EB11CB25F94476E77A1F789B94F508216EE4A47B6CEB3CD545CB00
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strlenstrstr
                                                                                                                                                                                                                            • String ID: <lambda>$co_names$code$lambda_$obfmode.c
                                                                                                                                                                                                                            • API String ID: 2393776628-2864150894
                                                                                                                                                                                                                            • Opcode ID: 4298df55d908ae6b00c1bc4abce4757f28cf3a7f0bca63ceb2e4e976d9f295b4
                                                                                                                                                                                                                            • Instruction ID: 5174a9ef9fe5e4dc51255108baa1c244eab3fc32d16ef77fe7032d1365121389
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4298df55d908ae6b00c1bc4abce4757f28cf3a7f0bca63ceb2e4e976d9f295b4
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9CB1BC62B19B88D5EB11CB22F94076D67A1FB49BC4F444216DE8E87B68EF3CE645C700
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: in != NULL$key != NULL$out != NULL$outlen != NULL$src/pk/rsa/rsa_sign_hash.c
                                                                                                                                                                                                                            • API String ID: 0-3034240082
                                                                                                                                                                                                                            • Opcode ID: 0bb27c29f26482e5b5c1161e10ef6663bb58d796734368bdc272243fb8d284c7
                                                                                                                                                                                                                            • Instruction ID: 4456b59188f1691b94ac0d6f82a27fa2ea331e733a37cc94e0ce282ede889d3f
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 0bb27c29f26482e5b5c1161e10ef6663bb58d796734368bdc272243fb8d284c7
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8F8148726086C48AD734CF11E594B9EB7A4F388784F90422AEE8A97B5CDB3DE544CF40
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: callocfree
                                                                                                                                                                                                                            • String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
                                                                                                                                                                                                                            • API String ID: 306872129-3913984646
                                                                                                                                                                                                                            • Opcode ID: 444b116cd9d96816306fbb4873725414264daca5175560474681bc1784c78b4c
                                                                                                                                                                                                                            • Instruction ID: 715d0dec13e00e256bb0e4845aad1ddc1f0027f22fdbd89583179ed8a96c80d9
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 444b116cd9d96816306fbb4873725414264daca5175560474681bc1784c78b4c
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1D417672B092C0DAE7318F12F9917CBB7A5F798384F80411A9A8987B9CDB7DD549CB40
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: sprintf$malloc
                                                                                                                                                                                                                            • String ID: %s%s$', %d)$(__name__, __file__, b'$\x%02x$__pyarmor__
                                                                                                                                                                                                                            • API String ID: 1197820334-965320081
                                                                                                                                                                                                                            • Opcode ID: e658fb96e59b2df53869f410621bb053eae9d2dfa1ce9c5a368bddbb9554b61e
                                                                                                                                                                                                                            • Instruction ID: 17f8eabeeaebb658e161cbccb45316386a7e11430fe04fbbceef8e12ced14e52
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e658fb96e59b2df53869f410621bb053eae9d2dfa1ce9c5a368bddbb9554b61e
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8721F327B65619A6DB04CB16AE1079D2355FB4CBD8F848221DE4E93328EA3CF44BC300
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • Address %p has no image-section, xrefs: 70A95749
                                                                                                                                                                                                                            • VirtualProtect failed with code 0x%x, xrefs: 70A956EA
                                                                                                                                                                                                                            • VirtualQuery failed for %d bytes at address %p, xrefs: 70A95738
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: QueryVirtual
                                                                                                                                                                                                                            • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                                                                                                                                                                            • API String ID: 1804819252-2123141913
                                                                                                                                                                                                                            • Opcode ID: 4f020e01b341bace898f75bec590f55d9cc10b1bef5ba748662d257ba5edb19b
                                                                                                                                                                                                                            • Instruction ID: 9274b2413f9a278cc1776aaad984eec909cb725b4ad131abdde4dcc0b6736b09
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 4f020e01b341bace898f75bec590f55d9cc10b1bef5ba748662d257ba5edb19b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3551BF76B21B40C6DB118F36E94279D77F1B748BA4F888225DE1E073A8DB38DA41C708
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _stat64$freemallocstrlen
                                                                                                                                                                                                                            • String ID: <unknown>
                                                                                                                                                                                                                            • API String ID: 2817875163-1574992787
                                                                                                                                                                                                                            • Opcode ID: 8c0098c45fd40d8f641e385b1fbcd43db39a531d668f04dff58a6d1f1933185a
                                                                                                                                                                                                                            • Instruction ID: cda43fdfdc26301d64b1cddae84ea05d977de089e3a0e5af88a0318a5aa49d91
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8c0098c45fd40d8f641e385b1fbcd43db39a531d668f04dff58a6d1f1933185a
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C751CE6232969088DB11CF21915032E7BF6EF89BD4F54C016EAC607B5CE73EC849D749
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: Internal buffer error$This function could not be called from the plain script$code$obfmode.c
                                                                                                                                                                                                                            • API String ID: 0-1583419685
                                                                                                                                                                                                                            • Opcode ID: 32f60d40e3bf896a25b500a6fb020a57787e95e766385b784b839396797fe673
                                                                                                                                                                                                                            • Instruction ID: bc497ab70437a1493618343c93e776d5b38f465a72e4a48d32615412fa8b1d3a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 32f60d40e3bf896a25b500a6fb020a57787e95e766385b784b839396797fe673
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: CDA17C32A19A09E5EB15CF15F98436A3360F749B85F804216DE4E87B28EF3CDA85C700
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: sprintf$strlen
                                                                                                                                                                                                                            • String ID: /%d:$No any serial number of harddisk got$platforms/windows/hdinfo.c
                                                                                                                                                                                                                            • API String ID: 3793847852-3769243694
                                                                                                                                                                                                                            • Opcode ID: 3a2ba334b1e53a30d99cff912c5635a5ae08b3b93a1053080f0b52ae43f6180b
                                                                                                                                                                                                                            • Instruction ID: d5e8c916c6d8f894e49bf41f13f21fa1e6242f8206bd0003e7c0705a5ee6266d
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 3a2ba334b1e53a30d99cff912c5635a5ae08b3b93a1053080f0b52ae43f6180b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 1031A263F190506DE7018A39FE103AD6722A7CABE2F588231DD26477DCD53D89D6C300
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: fclose$freefseekmalloc
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1339445139-0
                                                                                                                                                                                                                            • Opcode ID: e34edf35c7458ece52ed6851851156fc7003c0a5f88b762e469cb3089cece145
                                                                                                                                                                                                                            • Instruction ID: ebf56b3dd9eb5082c7addbd7c0d0b507daa696bf7fff19d89a5f318a4546b021
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: e34edf35c7458ece52ed6851851156fc7003c0a5f88b762e469cb3089cece145
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 9B11A7527222150CEA69AB6B7F0236E42929F89BE1F0C4635BE5E4775CFC78A5818344
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strlen$malloc
                                                                                                                                                                                                                            • String ID: %s%c%s$\$license.lic
                                                                                                                                                                                                                            • API String ID: 3157260142-3068191871
                                                                                                                                                                                                                            • Opcode ID: fedfa1928038d3d6c2651c61c0037678d7da86a14c0fbf6ad4b4bc5f6088cf00
                                                                                                                                                                                                                            • Instruction ID: 81c669a5276c4021c51a3705f84525ec7244f4d5615107f6c1cab23a112e2202
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: fedfa1928038d3d6c2651c61c0037678d7da86a14c0fbf6ad4b4bc5f6088cf00
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C8F0242275634888ED12CB06FE0029DA7986F89BE4F8C41309E0E0776CFA3CE6868304
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: N != NULL$src/math/rand_prime.c
                                                                                                                                                                                                                            • API String ID: 0-3192267683
                                                                                                                                                                                                                            • Opcode ID: b8f30702f3c24678b9152342381e30ce3c6e777f2e989fb07dd6339f75ddfc45
                                                                                                                                                                                                                            • Instruction ID: 998ee52b6b36e58258165d10d2910a950db4739e62d88d72547ad8ff1f22cf79
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: b8f30702f3c24678b9152342381e30ce3c6e777f2e989fb07dd6339f75ddfc45
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 8631F4327042448AE7259B16F80075EAA65BB49BD8F844135EE4B4BBACEB3CE946C300
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • GetSystemTimeAsFileTime.KERNEL32 ref: 70A952E5
                                                                                                                                                                                                                            • GetCurrentProcessId.KERNEL32 ref: 70A952F0
                                                                                                                                                                                                                            • GetCurrentThreadId.KERNEL32 ref: 70A952F9
                                                                                                                                                                                                                            • GetTickCount.KERNEL32 ref: 70A95301
                                                                                                                                                                                                                            • QueryPerformanceCounter.KERNEL32 ref: 70A9530E
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1445889803-0
                                                                                                                                                                                                                            • Opcode ID: 71deaa8847ac07225c0b9a9975ff01b325f0ff8b50d971686cfb165e8d7fa5ce
                                                                                                                                                                                                                            • Instruction ID: f3761bca60c6665eaf21dabe3c1515b7f0bc0244d165cda119bf1216d62064c8
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 71deaa8847ac07225c0b9a9975ff01b325f0ff8b50d971686cfb165e8d7fa5ce
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5B118C26B2AA1186FF104B25F80475963A0B74CBE1F4807359E9D47BA8DF3CE58A8704
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: strlen$malloc
                                                                                                                                                                                                                            • String ID: %s%c%s$\
                                                                                                                                                                                                                            • API String ID: 3157260142-3534329225
                                                                                                                                                                                                                            • Opcode ID: c75083ccf2fc9e9ed90fe062a2d8aec638cde238e072ff17e398c91c295b6986
                                                                                                                                                                                                                            • Instruction ID: a56ef2efd9655e9b67b9bd2a96483f142d409bec9570657dd2bbfcfe82ef5816
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: c75083ccf2fc9e9ed90fe062a2d8aec638cde238e072ff17e398c91c295b6986
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A8E092217513444DDD15DB06BA0025DB6845B89BD8F884134AD4E13B68EE3CF2898704
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: abortfwrite
                                                                                                                                                                                                                            • String ID: '$illegal index register
                                                                                                                                                                                                                            • API String ID: 1067672060-451399654
                                                                                                                                                                                                                            • Opcode ID: 9e072f5a76ee76b5e23c663f7146494ba32bc955bd6e66b7ddc4fd7bd7db62ef
                                                                                                                                                                                                                            • Instruction ID: c4c73163ca4511ecd9f23133aeb0b8fcb6c52a755dee99f73e836344a7d0caa2
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 9e072f5a76ee76b5e23c663f7146494ba32bc955bd6e66b7ddc4fd7bd7db62ef
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 54918D73A19B85C4DB128F3DE89064C3BA5E399F88B9AD112CA4D47718CB7ED856C311
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • This function could not be called from the plain script, xrefs: 70A10038
                                                                                                                                                                                                                            • Internal buffer error, xrefs: 70A10067
                                                                                                                                                                                                                            • Invalid license, xrefs: 70A10017
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: _time64
                                                                                                                                                                                                                            • String ID: Internal buffer error$Invalid license$This function could not be called from the plain script
                                                                                                                                                                                                                            • API String ID: 1670930206-992726897
                                                                                                                                                                                                                            • Opcode ID: 8f5478012960a087b17e483251a11bef36eed269b5a20717267066c89d0467ec
                                                                                                                                                                                                                            • Instruction ID: ffb9c6a7a9d7fc9b9715c256910517946ad9987e26b53f77d39ad43e34d9fba7
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8f5478012960a087b17e483251a11bef36eed269b5a20717267066c89d0467ec
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 37414A32A09A0AD1EB119B25F89035D73A4FB89B94F544726DD0ED7B78EF3CE685C201
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • platforms/windows/hdinfo.c, xrefs: 70A22510
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ErrorFormatFreeLastLocalMessage
                                                                                                                                                                                                                            • String ID: platforms/windows/hdinfo.c
                                                                                                                                                                                                                            • API String ID: 1365068426-3843089204
                                                                                                                                                                                                                            • Opcode ID: aa1f72af1f9256f694d27d04d8c1611766f73c4bae97df4e40b23cc10d957754
                                                                                                                                                                                                                            • Instruction ID: 9c98c81a8e37215b12f25d9795779afe9e028b7157acaca63fb4e2ee4a39468b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: aa1f72af1f9256f694d27d04d8c1611766f73c4bae97df4e40b23cc10d957754
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: C0F06D31608A41C2E710AB11E854B4A7771F3DDB85F604226EA8E43B68CF7DC24A8B40
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • strlen.MSVCRT ref: 70A96743
                                                                                                                                                                                                                            • malloc.MSVCRT(?,?,?,?,?,?,70A037BC), ref: 70A9674D
                                                                                                                                                                                                                            • strlen.MSVCRT ref: 70A96758
                                                                                                                                                                                                                            • malloc.MSVCRT(?,?,?,?,?,?,70A037BC), ref: 70A96762
                                                                                                                                                                                                                            • free.MSVCRT(?,?,?,?,?,?,70A037BC), ref: 70A967D9
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: mallocstrlen$free
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 2585366504-0
                                                                                                                                                                                                                            • Opcode ID: 32dceb0b36aab0059f3cfaeacc5f3b701959a5c9719d31260dde901367b1d541
                                                                                                                                                                                                                            • Instruction ID: 0638851f4a224caca41d9b8ee29da46d08603ffe5ff52579ef66635da8357622
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 32dceb0b36aab0059f3cfaeacc5f3b701959a5c9719d31260dde901367b1d541
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 5E1108127342A446D7199F36A5725AD7BE0DF9EFC8F488025FE8B47718EA2C9612C708
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: Sleep_amsg_exit
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1015461914-0
                                                                                                                                                                                                                            • Opcode ID: 7b7cd71a9208fb0481e2650ffc94a4d9b5aff767e2cfab8c3033c9da52f077ad
                                                                                                                                                                                                                            • Instruction ID: bc99b7e14b24fe4152f6a649d2fd9e99b7a5e05c75762759f3db96024c1b6c0b
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 7b7cd71a9208fb0481e2650ffc94a4d9b5aff767e2cfab8c3033c9da52f077ad
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: F6417E32B05548CAE7078F1AF96179962A5A78C7D4F44422AEE1D47358FF7CE981D340
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 70A334A2
                                                                                                                                                                                                                            • in != NULL, xrefs: 70A334A9
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID:
                                                                                                                                                                                                                            • String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
                                                                                                                                                                                                                            • API String ID: 0-85593093
                                                                                                                                                                                                                            • Opcode ID: 39c7469b54d8b4c0903769c72654553992ef81577ff0ea03e575e07bf30da348
                                                                                                                                                                                                                            • Instruction ID: c5c50bafb057d4c98f9029b9be243138ffdb16b6aadcdf3a3944475a03c1ba32
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 39c7469b54d8b4c0903769c72654553992ef81577ff0ea03e575e07bf30da348
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 7F312933B196808ADB168F1AE410B4DB265E748BD9FD48028EE4E4BB5CDF3DD555CB00
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: freestrrchr
                                                                                                                                                                                                                            • String ID: .pye
                                                                                                                                                                                                                            • API String ID: 4178315289-4135401513
                                                                                                                                                                                                                            • Opcode ID: a7290d11420c5b1f7c8822b372b0e5a339afccf7599878e0826a9257c3116ddc
                                                                                                                                                                                                                            • Instruction ID: c5cc54c390dd5510e514ba72ec433e583bf89fb7729368c3f054879e7df4961a
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: a7290d11420c5b1f7c8822b372b0e5a339afccf7599878e0826a9257c3116ddc
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: A911081271520499FE069B66FD1136D53A0AB89FD5F4845309E1E47768FE3CD8C6C304
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: memcpy
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 3510742995-0
                                                                                                                                                                                                                            • Opcode ID: 8887bcf00b9c5a0df90894ad054ff675871eafbc232aec6a5375fde6386eee60
                                                                                                                                                                                                                            • Instruction ID: 65fbc0bdf165173fd5fd41a4600feb4c3e846906f83a60a123f1867dfd944da4
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 8887bcf00b9c5a0df90894ad054ff675871eafbc232aec6a5375fde6386eee60
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: E5B105B26187C886CB42CB35E804A4F7FADEB05790F89C615EE5A4B39CE739C955D301
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            • __iob_func.MSVCRT ref: 70A2D410
                                                                                                                                                                                                                            • abort.MSVCRT(?,?,?,?,CA4587E7,70A2E01F,?,?,?,?,70A02A6C), ref: 70A2D431
                                                                                                                                                                                                                            Strings
                                                                                                                                                                                                                            • LTC_ARGCHK '%s' failure on line %d of file %s, xrefs: 70A2D416
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: __iob_funcabort
                                                                                                                                                                                                                            • String ID: LTC_ARGCHK '%s' failure on line %d of file %s
                                                                                                                                                                                                                            • API String ID: 1307436159-2823265812
                                                                                                                                                                                                                            • Opcode ID: 5d103e923e5a7a9d09fda6a27a1b82defeced1008c67a37ebcf131cac65a500b
                                                                                                                                                                                                                            • Instruction ID: cfd18097ad85927e3dac0dd476ad99f17a2c337413abb698c3df0880dc0f49d1
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 5d103e923e5a7a9d09fda6a27a1b82defeced1008c67a37ebcf131cac65a500b
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 3BD0A77172469991DA106B26AE40B9D9BA0FF9DFD4F888210FD8C93F249F18D206C340
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: ByteCharMultiWide$freestrlen
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 1041141762-0
                                                                                                                                                                                                                            • Opcode ID: 57f1290a326f2dbe84d055e9e2052765bfad467652e7252a51926d3e53e3bbe2
                                                                                                                                                                                                                            • Instruction ID: 8a1f0eaab414182a10af46e19658e632a64742d618426c4e4557ceb8789737f3
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 57f1290a326f2dbe84d055e9e2052765bfad467652e7252a51926d3e53e3bbe2
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 4DF0FF2270175449E728DB27BD41B1FAAD5BB8CBD8F484138AE8D43B68EF3CC5468304
                                                                                                                                                                                                                            APIs
                                                                                                                                                                                                                            Memory Dump Source
                                                                                                                                                                                                                            • Source File: 00000005.00000002.2083060284.0000000070A01000.00000020.00000001.01000000.00000013.sdmp, Offset: 70A00000, based on PE: true
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083029225.0000000070A00000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083119362.0000000070A98000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083148464.0000000070A99000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083233645.0000000070AF9000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083308769.0000000070B22000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083336096.0000000070B28000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083420207.0000000070B2A000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083455865.0000000070B2B000.00000004.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083482623.0000000070B2C000.00000008.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            • Associated: 00000005.00000002.2083509653.0000000070B2F000.00000002.00000001.01000000.00000013.sdmpDownload File
                                                                                                                                                                                                                            Joe Sandbox IDA Plugin
                                                                                                                                                                                                                            • Snapshot File: hcaresult_5_2_70a00000_explorer.jbxd
                                                                                                                                                                                                                            Similarity
                                                                                                                                                                                                                            • API ID: CriticalSection$EnterLeavefree
                                                                                                                                                                                                                            • String ID:
                                                                                                                                                                                                                            • API String ID: 4020351045-0
                                                                                                                                                                                                                            • Opcode ID: 30808cf927ee9382c705a8d2f4b6f333c7dc486d38e61c68925f0109574bc1ba
                                                                                                                                                                                                                            • Instruction ID: b8446c81e60ffb0577f0fc747a7d4a9b78ac1307dbeaf98736c5b9a10c5a5464
                                                                                                                                                                                                                            • Opcode Fuzzy Hash: 30808cf927ee9382c705a8d2f4b6f333c7dc486d38e61c68925f0109574bc1ba
                                                                                                                                                                                                                            • Instruction Fuzzy Hash: 0B015A71B29600C2EF0ACB75E8D131923E5FB98B90F548625C90E87328EB3CEA85C304